Linux Audio

Check our new training course

Loading...
v6.2
   1// SPDX-License-Identifier: GPL-2.0
   2/* Copyright (c) 2018 Facebook */
   3
   4#include <uapi/linux/btf.h>
   5#include <uapi/linux/bpf.h>
   6#include <uapi/linux/bpf_perf_event.h>
   7#include <uapi/linux/types.h>
   8#include <linux/seq_file.h>
   9#include <linux/compiler.h>
  10#include <linux/ctype.h>
  11#include <linux/errno.h>
  12#include <linux/slab.h>
  13#include <linux/anon_inodes.h>
  14#include <linux/file.h>
  15#include <linux/uaccess.h>
  16#include <linux/kernel.h>
  17#include <linux/idr.h>
  18#include <linux/sort.h>
  19#include <linux/bpf_verifier.h>
  20#include <linux/btf.h>
  21#include <linux/btf_ids.h>
 
  22#include <linux/bpf_lsm.h>
  23#include <linux/skmsg.h>
  24#include <linux/perf_event.h>
  25#include <linux/bsearch.h>
  26#include <linux/kobject.h>
  27#include <linux/sysfs.h>
 
 
 
  28#include <net/sock.h>
 
  29#include "../tools/lib/bpf/relo_core.h"
  30
  31/* BTF (BPF Type Format) is the meta data format which describes
  32 * the data types of BPF program/map.  Hence, it basically focus
  33 * on the C programming language which the modern BPF is primary
  34 * using.
  35 *
  36 * ELF Section:
  37 * ~~~~~~~~~~~
  38 * The BTF data is stored under the ".BTF" ELF section
  39 *
  40 * struct btf_type:
  41 * ~~~~~~~~~~~~~~~
  42 * Each 'struct btf_type' object describes a C data type.
  43 * Depending on the type it is describing, a 'struct btf_type'
  44 * object may be followed by more data.  F.e.
  45 * To describe an array, 'struct btf_type' is followed by
  46 * 'struct btf_array'.
  47 *
  48 * 'struct btf_type' and any extra data following it are
  49 * 4 bytes aligned.
  50 *
  51 * Type section:
  52 * ~~~~~~~~~~~~~
  53 * The BTF type section contains a list of 'struct btf_type' objects.
  54 * Each one describes a C type.  Recall from the above section
  55 * that a 'struct btf_type' object could be immediately followed by extra
  56 * data in order to describe some particular C types.
  57 *
  58 * type_id:
  59 * ~~~~~~~
  60 * Each btf_type object is identified by a type_id.  The type_id
  61 * is implicitly implied by the location of the btf_type object in
  62 * the BTF type section.  The first one has type_id 1.  The second
  63 * one has type_id 2...etc.  Hence, an earlier btf_type has
  64 * a smaller type_id.
  65 *
  66 * A btf_type object may refer to another btf_type object by using
  67 * type_id (i.e. the "type" in the "struct btf_type").
  68 *
  69 * NOTE that we cannot assume any reference-order.
  70 * A btf_type object can refer to an earlier btf_type object
  71 * but it can also refer to a later btf_type object.
  72 *
  73 * For example, to describe "const void *".  A btf_type
  74 * object describing "const" may refer to another btf_type
  75 * object describing "void *".  This type-reference is done
  76 * by specifying type_id:
  77 *
  78 * [1] CONST (anon) type_id=2
  79 * [2] PTR (anon) type_id=0
  80 *
  81 * The above is the btf_verifier debug log:
  82 *   - Each line started with "[?]" is a btf_type object
  83 *   - [?] is the type_id of the btf_type object.
  84 *   - CONST/PTR is the BTF_KIND_XXX
  85 *   - "(anon)" is the name of the type.  It just
  86 *     happens that CONST and PTR has no name.
  87 *   - type_id=XXX is the 'u32 type' in btf_type
  88 *
  89 * NOTE: "void" has type_id 0
  90 *
  91 * String section:
  92 * ~~~~~~~~~~~~~~
  93 * The BTF string section contains the names used by the type section.
  94 * Each string is referred by an "offset" from the beginning of the
  95 * string section.
  96 *
  97 * Each string is '\0' terminated.
  98 *
  99 * The first character in the string section must be '\0'
 100 * which is used to mean 'anonymous'. Some btf_type may not
 101 * have a name.
 102 */
 103
 104/* BTF verification:
 105 *
 106 * To verify BTF data, two passes are needed.
 107 *
 108 * Pass #1
 109 * ~~~~~~~
 110 * The first pass is to collect all btf_type objects to
 111 * an array: "btf->types".
 112 *
 113 * Depending on the C type that a btf_type is describing,
 114 * a btf_type may be followed by extra data.  We don't know
 115 * how many btf_type is there, and more importantly we don't
 116 * know where each btf_type is located in the type section.
 117 *
 118 * Without knowing the location of each type_id, most verifications
 119 * cannot be done.  e.g. an earlier btf_type may refer to a later
 120 * btf_type (recall the "const void *" above), so we cannot
 121 * check this type-reference in the first pass.
 122 *
 123 * In the first pass, it still does some verifications (e.g.
 124 * checking the name is a valid offset to the string section).
 125 *
 126 * Pass #2
 127 * ~~~~~~~
 128 * The main focus is to resolve a btf_type that is referring
 129 * to another type.
 130 *
 131 * We have to ensure the referring type:
 132 * 1) does exist in the BTF (i.e. in btf->types[])
 133 * 2) does not cause a loop:
 134 *	struct A {
 135 *		struct B b;
 136 *	};
 137 *
 138 *	struct B {
 139 *		struct A a;
 140 *	};
 141 *
 142 * btf_type_needs_resolve() decides if a btf_type needs
 143 * to be resolved.
 144 *
 145 * The needs_resolve type implements the "resolve()" ops which
 146 * essentially does a DFS and detects backedge.
 147 *
 148 * During resolve (or DFS), different C types have different
 149 * "RESOLVED" conditions.
 150 *
 151 * When resolving a BTF_KIND_STRUCT, we need to resolve all its
 152 * members because a member is always referring to another
 153 * type.  A struct's member can be treated as "RESOLVED" if
 154 * it is referring to a BTF_KIND_PTR.  Otherwise, the
 155 * following valid C struct would be rejected:
 156 *
 157 *	struct A {
 158 *		int m;
 159 *		struct A *a;
 160 *	};
 161 *
 162 * When resolving a BTF_KIND_PTR, it needs to keep resolving if
 163 * it is referring to another BTF_KIND_PTR.  Otherwise, we cannot
 164 * detect a pointer loop, e.g.:
 165 * BTF_KIND_CONST -> BTF_KIND_PTR -> BTF_KIND_CONST -> BTF_KIND_PTR +
 166 *                        ^                                         |
 167 *                        +-----------------------------------------+
 168 *
 169 */
 170
 171#define BITS_PER_U128 (sizeof(u64) * BITS_PER_BYTE * 2)
 172#define BITS_PER_BYTE_MASK (BITS_PER_BYTE - 1)
 173#define BITS_PER_BYTE_MASKED(bits) ((bits) & BITS_PER_BYTE_MASK)
 174#define BITS_ROUNDDOWN_BYTES(bits) ((bits) >> 3)
 175#define BITS_ROUNDUP_BYTES(bits) \
 176	(BITS_ROUNDDOWN_BYTES(bits) + !!BITS_PER_BYTE_MASKED(bits))
 177
 178#define BTF_INFO_MASK 0x9f00ffff
 179#define BTF_INT_MASK 0x0fffffff
 180#define BTF_TYPE_ID_VALID(type_id) ((type_id) <= BTF_MAX_TYPE)
 181#define BTF_STR_OFFSET_VALID(name_off) ((name_off) <= BTF_MAX_NAME_OFFSET)
 182
 183/* 16MB for 64k structs and each has 16 members and
 184 * a few MB spaces for the string section.
 185 * The hard limit is S32_MAX.
 186 */
 187#define BTF_MAX_SIZE (16 * 1024 * 1024)
 188
 189#define for_each_member_from(i, from, struct_type, member)		\
 190	for (i = from, member = btf_type_member(struct_type) + from;	\
 191	     i < btf_type_vlen(struct_type);				\
 192	     i++, member++)
 193
 194#define for_each_vsi_from(i, from, struct_type, member)				\
 195	for (i = from, member = btf_type_var_secinfo(struct_type) + from;	\
 196	     i < btf_type_vlen(struct_type);					\
 197	     i++, member++)
 198
 199DEFINE_IDR(btf_idr);
 200DEFINE_SPINLOCK(btf_idr_lock);
 201
 202enum btf_kfunc_hook {
 203	BTF_KFUNC_HOOK_COMMON,
 204	BTF_KFUNC_HOOK_XDP,
 205	BTF_KFUNC_HOOK_TC,
 206	BTF_KFUNC_HOOK_STRUCT_OPS,
 207	BTF_KFUNC_HOOK_TRACING,
 208	BTF_KFUNC_HOOK_SYSCALL,
 209	BTF_KFUNC_HOOK_FMODRET,
 
 
 
 
 
 
 
 210	BTF_KFUNC_HOOK_MAX,
 211};
 212
 213enum {
 214	BTF_KFUNC_SET_MAX_CNT = 256,
 215	BTF_DTOR_KFUNC_MAX_CNT = 256,
 
 
 
 
 
 
 216};
 217
 218struct btf_kfunc_set_tab {
 219	struct btf_id_set8 *sets[BTF_KFUNC_HOOK_MAX];
 
 220};
 221
 222struct btf_id_dtor_kfunc_tab {
 223	u32 cnt;
 224	struct btf_id_dtor_kfunc dtors[];
 225};
 226
 
 
 
 
 
 
 227struct btf {
 228	void *data;
 229	struct btf_type **types;
 230	u32 *resolved_ids;
 231	u32 *resolved_sizes;
 232	const char *strings;
 233	void *nohdr_data;
 234	struct btf_header hdr;
 235	u32 nr_types; /* includes VOID for base BTF */
 236	u32 types_size;
 237	u32 data_size;
 238	refcount_t refcnt;
 239	u32 id;
 240	struct rcu_head rcu;
 241	struct btf_kfunc_set_tab *kfunc_set_tab;
 242	struct btf_id_dtor_kfunc_tab *dtor_kfunc_tab;
 243	struct btf_struct_metas *struct_meta_tab;
 
 244
 245	/* split BTF support */
 246	struct btf *base_btf;
 247	u32 start_id; /* first type ID in this BTF (0 for base BTF) */
 248	u32 start_str_off; /* first string offset (0 for base BTF) */
 249	char name[MODULE_NAME_LEN];
 250	bool kernel_btf;
 
 251};
 252
 253enum verifier_phase {
 254	CHECK_META,
 255	CHECK_TYPE,
 256};
 257
 258struct resolve_vertex {
 259	const struct btf_type *t;
 260	u32 type_id;
 261	u16 next_member;
 262};
 263
 264enum visit_state {
 265	NOT_VISITED,
 266	VISITED,
 267	RESOLVED,
 268};
 269
 270enum resolve_mode {
 271	RESOLVE_TBD,	/* To Be Determined */
 272	RESOLVE_PTR,	/* Resolving for Pointer */
 273	RESOLVE_STRUCT_OR_ARRAY,	/* Resolving for struct/union
 274					 * or array
 275					 */
 276};
 277
 278#define MAX_RESOLVE_DEPTH 32
 279
 280struct btf_sec_info {
 281	u32 off;
 282	u32 len;
 283};
 284
 285struct btf_verifier_env {
 286	struct btf *btf;
 287	u8 *visit_states;
 288	struct resolve_vertex stack[MAX_RESOLVE_DEPTH];
 289	struct bpf_verifier_log log;
 290	u32 log_type_id;
 291	u32 top_stack;
 292	enum verifier_phase phase;
 293	enum resolve_mode resolve_mode;
 294};
 295
 296static const char * const btf_kind_str[NR_BTF_KINDS] = {
 297	[BTF_KIND_UNKN]		= "UNKNOWN",
 298	[BTF_KIND_INT]		= "INT",
 299	[BTF_KIND_PTR]		= "PTR",
 300	[BTF_KIND_ARRAY]	= "ARRAY",
 301	[BTF_KIND_STRUCT]	= "STRUCT",
 302	[BTF_KIND_UNION]	= "UNION",
 303	[BTF_KIND_ENUM]		= "ENUM",
 304	[BTF_KIND_FWD]		= "FWD",
 305	[BTF_KIND_TYPEDEF]	= "TYPEDEF",
 306	[BTF_KIND_VOLATILE]	= "VOLATILE",
 307	[BTF_KIND_CONST]	= "CONST",
 308	[BTF_KIND_RESTRICT]	= "RESTRICT",
 309	[BTF_KIND_FUNC]		= "FUNC",
 310	[BTF_KIND_FUNC_PROTO]	= "FUNC_PROTO",
 311	[BTF_KIND_VAR]		= "VAR",
 312	[BTF_KIND_DATASEC]	= "DATASEC",
 313	[BTF_KIND_FLOAT]	= "FLOAT",
 314	[BTF_KIND_DECL_TAG]	= "DECL_TAG",
 315	[BTF_KIND_TYPE_TAG]	= "TYPE_TAG",
 316	[BTF_KIND_ENUM64]	= "ENUM64",
 317};
 318
 319const char *btf_type_str(const struct btf_type *t)
 320{
 321	return btf_kind_str[BTF_INFO_KIND(t->info)];
 322}
 323
 324/* Chunk size we use in safe copy of data to be shown. */
 325#define BTF_SHOW_OBJ_SAFE_SIZE		32
 326
 327/*
 328 * This is the maximum size of a base type value (equivalent to a
 329 * 128-bit int); if we are at the end of our safe buffer and have
 330 * less than 16 bytes space we can't be assured of being able
 331 * to copy the next type safely, so in such cases we will initiate
 332 * a new copy.
 333 */
 334#define BTF_SHOW_OBJ_BASE_TYPE_SIZE	16
 335
 336/* Type name size */
 337#define BTF_SHOW_NAME_SIZE		80
 338
 339/*
 
 
 
 
 
 
 340 * Common data to all BTF show operations. Private show functions can add
 341 * their own data to a structure containing a struct btf_show and consult it
 342 * in the show callback.  See btf_type_show() below.
 343 *
 344 * One challenge with showing nested data is we want to skip 0-valued
 345 * data, but in order to figure out whether a nested object is all zeros
 346 * we need to walk through it.  As a result, we need to make two passes
 347 * when handling structs, unions and arrays; the first path simply looks
 348 * for nonzero data, while the second actually does the display.  The first
 349 * pass is signalled by show->state.depth_check being set, and if we
 350 * encounter a non-zero value we set show->state.depth_to_show to
 351 * the depth at which we encountered it.  When we have completed the
 352 * first pass, we will know if anything needs to be displayed if
 353 * depth_to_show > depth.  See btf_[struct,array]_show() for the
 354 * implementation of this.
 355 *
 356 * Another problem is we want to ensure the data for display is safe to
 357 * access.  To support this, the anonymous "struct {} obj" tracks the data
 358 * object and our safe copy of it.  We copy portions of the data needed
 359 * to the object "copy" buffer, but because its size is limited to
 360 * BTF_SHOW_OBJ_COPY_LEN bytes, multiple copies may be required as we
 361 * traverse larger objects for display.
 362 *
 363 * The various data type show functions all start with a call to
 364 * btf_show_start_type() which returns a pointer to the safe copy
 365 * of the data needed (or if BTF_SHOW_UNSAFE is specified, to the
 366 * raw data itself).  btf_show_obj_safe() is responsible for
 367 * using copy_from_kernel_nofault() to update the safe data if necessary
 368 * as we traverse the object's data.  skbuff-like semantics are
 369 * used:
 370 *
 371 * - obj.head points to the start of the toplevel object for display
 372 * - obj.size is the size of the toplevel object
 373 * - obj.data points to the current point in the original data at
 374 *   which our safe data starts.  obj.data will advance as we copy
 375 *   portions of the data.
 376 *
 377 * In most cases a single copy will suffice, but larger data structures
 378 * such as "struct task_struct" will require many copies.  The logic in
 379 * btf_show_obj_safe() handles the logic that determines if a new
 380 * copy_from_kernel_nofault() is needed.
 381 */
 382struct btf_show {
 383	u64 flags;
 384	void *target;	/* target of show operation (seq file, buffer) */
 385	void (*showfn)(struct btf_show *show, const char *fmt, va_list args);
 386	const struct btf *btf;
 387	/* below are used during iteration */
 388	struct {
 389		u8 depth;
 390		u8 depth_to_show;
 391		u8 depth_check;
 392		u8 array_member:1,
 393		   array_terminated:1;
 394		u16 array_encoding;
 395		u32 type_id;
 396		int status;			/* non-zero for error */
 397		const struct btf_type *type;
 398		const struct btf_member *member;
 399		char name[BTF_SHOW_NAME_SIZE];	/* space for member name/type */
 400	} state;
 401	struct {
 402		u32 size;
 403		void *head;
 404		void *data;
 405		u8 safe[BTF_SHOW_OBJ_SAFE_SIZE];
 406	} obj;
 407};
 408
 409struct btf_kind_operations {
 410	s32 (*check_meta)(struct btf_verifier_env *env,
 411			  const struct btf_type *t,
 412			  u32 meta_left);
 413	int (*resolve)(struct btf_verifier_env *env,
 414		       const struct resolve_vertex *v);
 415	int (*check_member)(struct btf_verifier_env *env,
 416			    const struct btf_type *struct_type,
 417			    const struct btf_member *member,
 418			    const struct btf_type *member_type);
 419	int (*check_kflag_member)(struct btf_verifier_env *env,
 420				  const struct btf_type *struct_type,
 421				  const struct btf_member *member,
 422				  const struct btf_type *member_type);
 423	void (*log_details)(struct btf_verifier_env *env,
 424			    const struct btf_type *t);
 425	void (*show)(const struct btf *btf, const struct btf_type *t,
 426			 u32 type_id, void *data, u8 bits_offsets,
 427			 struct btf_show *show);
 428};
 429
 430static const struct btf_kind_operations * const kind_ops[NR_BTF_KINDS];
 431static struct btf_type btf_void;
 432
 433static int btf_resolve(struct btf_verifier_env *env,
 434		       const struct btf_type *t, u32 type_id);
 435
 436static int btf_func_check(struct btf_verifier_env *env,
 437			  const struct btf_type *t);
 438
 439static bool btf_type_is_modifier(const struct btf_type *t)
 440{
 441	/* Some of them is not strictly a C modifier
 442	 * but they are grouped into the same bucket
 443	 * for BTF concern:
 444	 *   A type (t) that refers to another
 445	 *   type through t->type AND its size cannot
 446	 *   be determined without following the t->type.
 447	 *
 448	 * ptr does not fall into this bucket
 449	 * because its size is always sizeof(void *).
 450	 */
 451	switch (BTF_INFO_KIND(t->info)) {
 452	case BTF_KIND_TYPEDEF:
 453	case BTF_KIND_VOLATILE:
 454	case BTF_KIND_CONST:
 455	case BTF_KIND_RESTRICT:
 456	case BTF_KIND_TYPE_TAG:
 457		return true;
 458	}
 459
 460	return false;
 461}
 462
 463bool btf_type_is_void(const struct btf_type *t)
 464{
 465	return t == &btf_void;
 466}
 467
 468static bool btf_type_is_fwd(const struct btf_type *t)
 
 
 
 
 
 469{
 470	return BTF_INFO_KIND(t->info) == BTF_KIND_FWD;
 471}
 472
 473static bool btf_type_nosize(const struct btf_type *t)
 474{
 475	return btf_type_is_void(t) || btf_type_is_fwd(t) ||
 476	       btf_type_is_func(t) || btf_type_is_func_proto(t);
 
 477}
 478
 479static bool btf_type_nosize_or_null(const struct btf_type *t)
 480{
 481	return !t || btf_type_nosize(t);
 482}
 483
 484static bool btf_type_is_datasec(const struct btf_type *t)
 485{
 486	return BTF_INFO_KIND(t->info) == BTF_KIND_DATASEC;
 487}
 488
 489static bool btf_type_is_decl_tag(const struct btf_type *t)
 490{
 491	return BTF_INFO_KIND(t->info) == BTF_KIND_DECL_TAG;
 492}
 493
 494static bool btf_type_is_decl_tag_target(const struct btf_type *t)
 495{
 496	return btf_type_is_func(t) || btf_type_is_struct(t) ||
 497	       btf_type_is_var(t) || btf_type_is_typedef(t);
 498}
 499
 
 
 
 
 
 500u32 btf_nr_types(const struct btf *btf)
 501{
 502	u32 total = 0;
 503
 504	while (btf) {
 505		total += btf->nr_types;
 506		btf = btf->base_btf;
 507	}
 508
 509	return total;
 510}
 511
 512s32 btf_find_by_name_kind(const struct btf *btf, const char *name, u8 kind)
 513{
 514	const struct btf_type *t;
 515	const char *tname;
 516	u32 i, total;
 517
 518	total = btf_nr_types(btf);
 519	for (i = 1; i < total; i++) {
 520		t = btf_type_by_id(btf, i);
 521		if (BTF_INFO_KIND(t->info) != kind)
 522			continue;
 523
 524		tname = btf_name_by_offset(btf, t->name_off);
 525		if (!strcmp(tname, name))
 526			return i;
 527	}
 528
 529	return -ENOENT;
 530}
 531
 532static s32 bpf_find_btf_id(const char *name, u32 kind, struct btf **btf_p)
 533{
 534	struct btf *btf;
 535	s32 ret;
 536	int id;
 537
 538	btf = bpf_get_btf_vmlinux();
 539	if (IS_ERR(btf))
 540		return PTR_ERR(btf);
 541	if (!btf)
 542		return -EINVAL;
 543
 544	ret = btf_find_by_name_kind(btf, name, kind);
 545	/* ret is never zero, since btf_find_by_name_kind returns
 546	 * positive btf_id or negative error.
 547	 */
 548	if (ret > 0) {
 549		btf_get(btf);
 550		*btf_p = btf;
 551		return ret;
 552	}
 553
 554	/* If name is not found in vmlinux's BTF then search in module's BTFs */
 555	spin_lock_bh(&btf_idr_lock);
 556	idr_for_each_entry(&btf_idr, btf, id) {
 557		if (!btf_is_module(btf))
 558			continue;
 559		/* linear search could be slow hence unlock/lock
 560		 * the IDR to avoiding holding it for too long
 561		 */
 562		btf_get(btf);
 563		spin_unlock_bh(&btf_idr_lock);
 564		ret = btf_find_by_name_kind(btf, name, kind);
 565		if (ret > 0) {
 566			*btf_p = btf;
 567			return ret;
 568		}
 569		spin_lock_bh(&btf_idr_lock);
 570		btf_put(btf);
 
 571	}
 572	spin_unlock_bh(&btf_idr_lock);
 573	return ret;
 574}
 575
 576const struct btf_type *btf_type_skip_modifiers(const struct btf *btf,
 577					       u32 id, u32 *res_id)
 578{
 579	const struct btf_type *t = btf_type_by_id(btf, id);
 580
 581	while (btf_type_is_modifier(t)) {
 582		id = t->type;
 583		t = btf_type_by_id(btf, t->type);
 584	}
 585
 586	if (res_id)
 587		*res_id = id;
 588
 589	return t;
 590}
 591
 592const struct btf_type *btf_type_resolve_ptr(const struct btf *btf,
 593					    u32 id, u32 *res_id)
 594{
 595	const struct btf_type *t;
 596
 597	t = btf_type_skip_modifiers(btf, id, NULL);
 598	if (!btf_type_is_ptr(t))
 599		return NULL;
 600
 601	return btf_type_skip_modifiers(btf, t->type, res_id);
 602}
 603
 604const struct btf_type *btf_type_resolve_func_ptr(const struct btf *btf,
 605						 u32 id, u32 *res_id)
 606{
 607	const struct btf_type *ptype;
 608
 609	ptype = btf_type_resolve_ptr(btf, id, res_id);
 610	if (ptype && btf_type_is_func_proto(ptype))
 611		return ptype;
 612
 613	return NULL;
 614}
 615
 616/* Types that act only as a source, not sink or intermediate
 617 * type when resolving.
 618 */
 619static bool btf_type_is_resolve_source_only(const struct btf_type *t)
 620{
 621	return btf_type_is_var(t) ||
 622	       btf_type_is_decl_tag(t) ||
 623	       btf_type_is_datasec(t);
 624}
 625
 626/* What types need to be resolved?
 627 *
 628 * btf_type_is_modifier() is an obvious one.
 629 *
 630 * btf_type_is_struct() because its member refers to
 631 * another type (through member->type).
 632 *
 633 * btf_type_is_var() because the variable refers to
 634 * another type. btf_type_is_datasec() holds multiple
 635 * btf_type_is_var() types that need resolving.
 636 *
 637 * btf_type_is_array() because its element (array->type)
 638 * refers to another type.  Array can be thought of a
 639 * special case of struct while array just has the same
 640 * member-type repeated by array->nelems of times.
 641 */
 642static bool btf_type_needs_resolve(const struct btf_type *t)
 643{
 644	return btf_type_is_modifier(t) ||
 645	       btf_type_is_ptr(t) ||
 646	       btf_type_is_struct(t) ||
 647	       btf_type_is_array(t) ||
 648	       btf_type_is_var(t) ||
 649	       btf_type_is_func(t) ||
 650	       btf_type_is_decl_tag(t) ||
 651	       btf_type_is_datasec(t);
 652}
 653
 654/* t->size can be used */
 655static bool btf_type_has_size(const struct btf_type *t)
 656{
 657	switch (BTF_INFO_KIND(t->info)) {
 658	case BTF_KIND_INT:
 659	case BTF_KIND_STRUCT:
 660	case BTF_KIND_UNION:
 661	case BTF_KIND_ENUM:
 662	case BTF_KIND_DATASEC:
 663	case BTF_KIND_FLOAT:
 664	case BTF_KIND_ENUM64:
 665		return true;
 666	}
 667
 668	return false;
 669}
 670
 671static const char *btf_int_encoding_str(u8 encoding)
 672{
 673	if (encoding == 0)
 674		return "(none)";
 675	else if (encoding == BTF_INT_SIGNED)
 676		return "SIGNED";
 677	else if (encoding == BTF_INT_CHAR)
 678		return "CHAR";
 679	else if (encoding == BTF_INT_BOOL)
 680		return "BOOL";
 681	else
 682		return "UNKN";
 683}
 684
 685static u32 btf_type_int(const struct btf_type *t)
 686{
 687	return *(u32 *)(t + 1);
 688}
 689
 690static const struct btf_array *btf_type_array(const struct btf_type *t)
 691{
 692	return (const struct btf_array *)(t + 1);
 693}
 694
 695static const struct btf_enum *btf_type_enum(const struct btf_type *t)
 696{
 697	return (const struct btf_enum *)(t + 1);
 698}
 699
 700static const struct btf_var *btf_type_var(const struct btf_type *t)
 701{
 702	return (const struct btf_var *)(t + 1);
 703}
 704
 705static const struct btf_decl_tag *btf_type_decl_tag(const struct btf_type *t)
 706{
 707	return (const struct btf_decl_tag *)(t + 1);
 708}
 709
 710static const struct btf_enum64 *btf_type_enum64(const struct btf_type *t)
 711{
 712	return (const struct btf_enum64 *)(t + 1);
 713}
 714
 715static const struct btf_kind_operations *btf_type_ops(const struct btf_type *t)
 716{
 717	return kind_ops[BTF_INFO_KIND(t->info)];
 718}
 719
 720static bool btf_name_offset_valid(const struct btf *btf, u32 offset)
 721{
 722	if (!BTF_STR_OFFSET_VALID(offset))
 723		return false;
 724
 725	while (offset < btf->start_str_off)
 726		btf = btf->base_btf;
 727
 728	offset -= btf->start_str_off;
 729	return offset < btf->hdr.str_len;
 730}
 731
 732static bool __btf_name_char_ok(char c, bool first, bool dot_ok)
 733{
 734	if ((first ? !isalpha(c) :
 735		     !isalnum(c)) &&
 736	    c != '_' &&
 737	    ((c == '.' && !dot_ok) ||
 738	      c != '.'))
 739		return false;
 740	return true;
 741}
 742
 743static const char *btf_str_by_offset(const struct btf *btf, u32 offset)
 744{
 745	while (offset < btf->start_str_off)
 746		btf = btf->base_btf;
 747
 748	offset -= btf->start_str_off;
 749	if (offset < btf->hdr.str_len)
 750		return &btf->strings[offset];
 751
 752	return NULL;
 753}
 754
 755static bool __btf_name_valid(const struct btf *btf, u32 offset, bool dot_ok)
 756{
 757	/* offset must be valid */
 758	const char *src = btf_str_by_offset(btf, offset);
 759	const char *src_limit;
 760
 761	if (!__btf_name_char_ok(*src, true, dot_ok))
 762		return false;
 763
 764	/* set a limit on identifier length */
 765	src_limit = src + KSYM_NAME_LEN;
 766	src++;
 767	while (*src && src < src_limit) {
 768		if (!__btf_name_char_ok(*src, false, dot_ok))
 769			return false;
 770		src++;
 771	}
 772
 773	return !*src;
 774}
 775
 776/* Only C-style identifier is permitted. This can be relaxed if
 777 * necessary.
 778 */
 779static bool btf_name_valid_identifier(const struct btf *btf, u32 offset)
 780{
 781	return __btf_name_valid(btf, offset, false);
 782}
 783
 784static bool btf_name_valid_section(const struct btf *btf, u32 offset)
 785{
 786	return __btf_name_valid(btf, offset, true);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 787}
 788
 789static const char *__btf_name_by_offset(const struct btf *btf, u32 offset)
 790{
 791	const char *name;
 792
 793	if (!offset)
 794		return "(anon)";
 795
 796	name = btf_str_by_offset(btf, offset);
 797	return name ?: "(invalid-name-offset)";
 798}
 799
 800const char *btf_name_by_offset(const struct btf *btf, u32 offset)
 801{
 802	return btf_str_by_offset(btf, offset);
 803}
 804
 805const struct btf_type *btf_type_by_id(const struct btf *btf, u32 type_id)
 806{
 807	while (type_id < btf->start_id)
 808		btf = btf->base_btf;
 809
 810	type_id -= btf->start_id;
 811	if (type_id >= btf->nr_types)
 812		return NULL;
 813	return btf->types[type_id];
 814}
 815EXPORT_SYMBOL_GPL(btf_type_by_id);
 816
 817/*
 818 * Regular int is not a bit field and it must be either
 819 * u8/u16/u32/u64 or __int128.
 820 */
 821static bool btf_type_int_is_regular(const struct btf_type *t)
 822{
 823	u8 nr_bits, nr_bytes;
 824	u32 int_data;
 825
 826	int_data = btf_type_int(t);
 827	nr_bits = BTF_INT_BITS(int_data);
 828	nr_bytes = BITS_ROUNDUP_BYTES(nr_bits);
 829	if (BITS_PER_BYTE_MASKED(nr_bits) ||
 830	    BTF_INT_OFFSET(int_data) ||
 831	    (nr_bytes != sizeof(u8) && nr_bytes != sizeof(u16) &&
 832	     nr_bytes != sizeof(u32) && nr_bytes != sizeof(u64) &&
 833	     nr_bytes != (2 * sizeof(u64)))) {
 834		return false;
 835	}
 836
 837	return true;
 838}
 839
 840/*
 841 * Check that given struct member is a regular int with expected
 842 * offset and size.
 843 */
 844bool btf_member_is_reg_int(const struct btf *btf, const struct btf_type *s,
 845			   const struct btf_member *m,
 846			   u32 expected_offset, u32 expected_size)
 847{
 848	const struct btf_type *t;
 849	u32 id, int_data;
 850	u8 nr_bits;
 851
 852	id = m->type;
 853	t = btf_type_id_size(btf, &id, NULL);
 854	if (!t || !btf_type_is_int(t))
 855		return false;
 856
 857	int_data = btf_type_int(t);
 858	nr_bits = BTF_INT_BITS(int_data);
 859	if (btf_type_kflag(s)) {
 860		u32 bitfield_size = BTF_MEMBER_BITFIELD_SIZE(m->offset);
 861		u32 bit_offset = BTF_MEMBER_BIT_OFFSET(m->offset);
 862
 863		/* if kflag set, int should be a regular int and
 864		 * bit offset should be at byte boundary.
 865		 */
 866		return !bitfield_size &&
 867		       BITS_ROUNDUP_BYTES(bit_offset) == expected_offset &&
 868		       BITS_ROUNDUP_BYTES(nr_bits) == expected_size;
 869	}
 870
 871	if (BTF_INT_OFFSET(int_data) ||
 872	    BITS_PER_BYTE_MASKED(m->offset) ||
 873	    BITS_ROUNDUP_BYTES(m->offset) != expected_offset ||
 874	    BITS_PER_BYTE_MASKED(nr_bits) ||
 875	    BITS_ROUNDUP_BYTES(nr_bits) != expected_size)
 876		return false;
 877
 878	return true;
 879}
 880
 881/* Similar to btf_type_skip_modifiers() but does not skip typedefs. */
 882static const struct btf_type *btf_type_skip_qualifiers(const struct btf *btf,
 883						       u32 id)
 884{
 885	const struct btf_type *t = btf_type_by_id(btf, id);
 886
 887	while (btf_type_is_modifier(t) &&
 888	       BTF_INFO_KIND(t->info) != BTF_KIND_TYPEDEF) {
 889		t = btf_type_by_id(btf, t->type);
 890	}
 891
 892	return t;
 893}
 894
 895#define BTF_SHOW_MAX_ITER	10
 896
 897#define BTF_KIND_BIT(kind)	(1ULL << kind)
 898
 899/*
 900 * Populate show->state.name with type name information.
 901 * Format of type name is
 902 *
 903 * [.member_name = ] (type_name)
 904 */
 905static const char *btf_show_name(struct btf_show *show)
 906{
 907	/* BTF_MAX_ITER array suffixes "[]" */
 908	const char *array_suffixes = "[][][][][][][][][][]";
 909	const char *array_suffix = &array_suffixes[strlen(array_suffixes)];
 910	/* BTF_MAX_ITER pointer suffixes "*" */
 911	const char *ptr_suffixes = "**********";
 912	const char *ptr_suffix = &ptr_suffixes[strlen(ptr_suffixes)];
 913	const char *name = NULL, *prefix = "", *parens = "";
 914	const struct btf_member *m = show->state.member;
 915	const struct btf_type *t;
 916	const struct btf_array *array;
 917	u32 id = show->state.type_id;
 918	const char *member = NULL;
 919	bool show_member = false;
 920	u64 kinds = 0;
 921	int i;
 922
 923	show->state.name[0] = '\0';
 924
 925	/*
 926	 * Don't show type name if we're showing an array member;
 927	 * in that case we show the array type so don't need to repeat
 928	 * ourselves for each member.
 929	 */
 930	if (show->state.array_member)
 931		return "";
 932
 933	/* Retrieve member name, if any. */
 934	if (m) {
 935		member = btf_name_by_offset(show->btf, m->name_off);
 936		show_member = strlen(member) > 0;
 937		id = m->type;
 938	}
 939
 940	/*
 941	 * Start with type_id, as we have resolved the struct btf_type *
 942	 * via btf_modifier_show() past the parent typedef to the child
 943	 * struct, int etc it is defined as.  In such cases, the type_id
 944	 * still represents the starting type while the struct btf_type *
 945	 * in our show->state points at the resolved type of the typedef.
 946	 */
 947	t = btf_type_by_id(show->btf, id);
 948	if (!t)
 949		return "";
 950
 951	/*
 952	 * The goal here is to build up the right number of pointer and
 953	 * array suffixes while ensuring the type name for a typedef
 954	 * is represented.  Along the way we accumulate a list of
 955	 * BTF kinds we have encountered, since these will inform later
 956	 * display; for example, pointer types will not require an
 957	 * opening "{" for struct, we will just display the pointer value.
 958	 *
 959	 * We also want to accumulate the right number of pointer or array
 960	 * indices in the format string while iterating until we get to
 961	 * the typedef/pointee/array member target type.
 962	 *
 963	 * We start by pointing at the end of pointer and array suffix
 964	 * strings; as we accumulate pointers and arrays we move the pointer
 965	 * or array string backwards so it will show the expected number of
 966	 * '*' or '[]' for the type.  BTF_SHOW_MAX_ITER of nesting of pointers
 967	 * and/or arrays and typedefs are supported as a precaution.
 968	 *
 969	 * We also want to get typedef name while proceeding to resolve
 970	 * type it points to so that we can add parentheses if it is a
 971	 * "typedef struct" etc.
 972	 */
 973	for (i = 0; i < BTF_SHOW_MAX_ITER; i++) {
 974
 975		switch (BTF_INFO_KIND(t->info)) {
 976		case BTF_KIND_TYPEDEF:
 977			if (!name)
 978				name = btf_name_by_offset(show->btf,
 979							       t->name_off);
 980			kinds |= BTF_KIND_BIT(BTF_KIND_TYPEDEF);
 981			id = t->type;
 982			break;
 983		case BTF_KIND_ARRAY:
 984			kinds |= BTF_KIND_BIT(BTF_KIND_ARRAY);
 985			parens = "[";
 986			if (!t)
 987				return "";
 988			array = btf_type_array(t);
 989			if (array_suffix > array_suffixes)
 990				array_suffix -= 2;
 991			id = array->type;
 992			break;
 993		case BTF_KIND_PTR:
 994			kinds |= BTF_KIND_BIT(BTF_KIND_PTR);
 995			if (ptr_suffix > ptr_suffixes)
 996				ptr_suffix -= 1;
 997			id = t->type;
 998			break;
 999		default:
1000			id = 0;
1001			break;
1002		}
1003		if (!id)
1004			break;
1005		t = btf_type_skip_qualifiers(show->btf, id);
1006	}
1007	/* We may not be able to represent this type; bail to be safe */
1008	if (i == BTF_SHOW_MAX_ITER)
1009		return "";
1010
1011	if (!name)
1012		name = btf_name_by_offset(show->btf, t->name_off);
1013
1014	switch (BTF_INFO_KIND(t->info)) {
1015	case BTF_KIND_STRUCT:
1016	case BTF_KIND_UNION:
1017		prefix = BTF_INFO_KIND(t->info) == BTF_KIND_STRUCT ?
1018			 "struct" : "union";
1019		/* if it's an array of struct/union, parens is already set */
1020		if (!(kinds & (BTF_KIND_BIT(BTF_KIND_ARRAY))))
1021			parens = "{";
1022		break;
1023	case BTF_KIND_ENUM:
1024	case BTF_KIND_ENUM64:
1025		prefix = "enum";
1026		break;
1027	default:
1028		break;
1029	}
1030
1031	/* pointer does not require parens */
1032	if (kinds & BTF_KIND_BIT(BTF_KIND_PTR))
1033		parens = "";
1034	/* typedef does not require struct/union/enum prefix */
1035	if (kinds & BTF_KIND_BIT(BTF_KIND_TYPEDEF))
1036		prefix = "";
1037
1038	if (!name)
1039		name = "";
1040
1041	/* Even if we don't want type name info, we want parentheses etc */
1042	if (show->flags & BTF_SHOW_NONAME)
1043		snprintf(show->state.name, sizeof(show->state.name), "%s",
1044			 parens);
1045	else
1046		snprintf(show->state.name, sizeof(show->state.name),
1047			 "%s%s%s(%s%s%s%s%s%s)%s",
1048			 /* first 3 strings comprise ".member = " */
1049			 show_member ? "." : "",
1050			 show_member ? member : "",
1051			 show_member ? " = " : "",
1052			 /* ...next is our prefix (struct, enum, etc) */
1053			 prefix,
1054			 strlen(prefix) > 0 && strlen(name) > 0 ? " " : "",
1055			 /* ...this is the type name itself */
1056			 name,
1057			 /* ...suffixed by the appropriate '*', '[]' suffixes */
1058			 strlen(ptr_suffix) > 0 ? " " : "", ptr_suffix,
1059			 array_suffix, parens);
1060
1061	return show->state.name;
1062}
1063
1064static const char *__btf_show_indent(struct btf_show *show)
1065{
1066	const char *indents = "                                ";
1067	const char *indent = &indents[strlen(indents)];
1068
1069	if ((indent - show->state.depth) >= indents)
1070		return indent - show->state.depth;
1071	return indents;
1072}
1073
1074static const char *btf_show_indent(struct btf_show *show)
1075{
1076	return show->flags & BTF_SHOW_COMPACT ? "" : __btf_show_indent(show);
1077}
1078
1079static const char *btf_show_newline(struct btf_show *show)
1080{
1081	return show->flags & BTF_SHOW_COMPACT ? "" : "\n";
1082}
1083
1084static const char *btf_show_delim(struct btf_show *show)
1085{
1086	if (show->state.depth == 0)
1087		return "";
1088
1089	if ((show->flags & BTF_SHOW_COMPACT) && show->state.type &&
1090		BTF_INFO_KIND(show->state.type->info) == BTF_KIND_UNION)
1091		return "|";
1092
1093	return ",";
1094}
1095
1096__printf(2, 3) static void btf_show(struct btf_show *show, const char *fmt, ...)
1097{
1098	va_list args;
1099
1100	if (!show->state.depth_check) {
1101		va_start(args, fmt);
1102		show->showfn(show, fmt, args);
1103		va_end(args);
1104	}
1105}
1106
1107/* Macros are used here as btf_show_type_value[s]() prepends and appends
1108 * format specifiers to the format specifier passed in; these do the work of
1109 * adding indentation, delimiters etc while the caller simply has to specify
1110 * the type value(s) in the format specifier + value(s).
1111 */
1112#define btf_show_type_value(show, fmt, value)				       \
1113	do {								       \
1114		if ((value) != (__typeof__(value))0 ||			       \
1115		    (show->flags & BTF_SHOW_ZERO) ||			       \
1116		    show->state.depth == 0) {				       \
1117			btf_show(show, "%s%s" fmt "%s%s",		       \
1118				 btf_show_indent(show),			       \
1119				 btf_show_name(show),			       \
1120				 value, btf_show_delim(show),		       \
1121				 btf_show_newline(show));		       \
1122			if (show->state.depth > show->state.depth_to_show)     \
1123				show->state.depth_to_show = show->state.depth; \
1124		}							       \
1125	} while (0)
1126
1127#define btf_show_type_values(show, fmt, ...)				       \
1128	do {								       \
1129		btf_show(show, "%s%s" fmt "%s%s", btf_show_indent(show),       \
1130			 btf_show_name(show),				       \
1131			 __VA_ARGS__, btf_show_delim(show),		       \
1132			 btf_show_newline(show));			       \
1133		if (show->state.depth > show->state.depth_to_show)	       \
1134			show->state.depth_to_show = show->state.depth;	       \
1135	} while (0)
1136
1137/* How much is left to copy to safe buffer after @data? */
1138static int btf_show_obj_size_left(struct btf_show *show, void *data)
1139{
1140	return show->obj.head + show->obj.size - data;
1141}
1142
1143/* Is object pointed to by @data of @size already copied to our safe buffer? */
1144static bool btf_show_obj_is_safe(struct btf_show *show, void *data, int size)
1145{
1146	return data >= show->obj.data &&
1147	       (data + size) < (show->obj.data + BTF_SHOW_OBJ_SAFE_SIZE);
1148}
1149
1150/*
1151 * If object pointed to by @data of @size falls within our safe buffer, return
1152 * the equivalent pointer to the same safe data.  Assumes
1153 * copy_from_kernel_nofault() has already happened and our safe buffer is
1154 * populated.
1155 */
1156static void *__btf_show_obj_safe(struct btf_show *show, void *data, int size)
1157{
1158	if (btf_show_obj_is_safe(show, data, size))
1159		return show->obj.safe + (data - show->obj.data);
1160	return NULL;
1161}
1162
1163/*
1164 * Return a safe-to-access version of data pointed to by @data.
1165 * We do this by copying the relevant amount of information
1166 * to the struct btf_show obj.safe buffer using copy_from_kernel_nofault().
1167 *
1168 * If BTF_SHOW_UNSAFE is specified, just return data as-is; no
1169 * safe copy is needed.
1170 *
1171 * Otherwise we need to determine if we have the required amount
1172 * of data (determined by the @data pointer and the size of the
1173 * largest base type we can encounter (represented by
1174 * BTF_SHOW_OBJ_BASE_TYPE_SIZE). Having that much data ensures
1175 * that we will be able to print some of the current object,
1176 * and if more is needed a copy will be triggered.
1177 * Some objects such as structs will not fit into the buffer;
1178 * in such cases additional copies when we iterate over their
1179 * members may be needed.
1180 *
1181 * btf_show_obj_safe() is used to return a safe buffer for
1182 * btf_show_start_type(); this ensures that as we recurse into
1183 * nested types we always have safe data for the given type.
1184 * This approach is somewhat wasteful; it's possible for example
1185 * that when iterating over a large union we'll end up copying the
1186 * same data repeatedly, but the goal is safety not performance.
1187 * We use stack data as opposed to per-CPU buffers because the
1188 * iteration over a type can take some time, and preemption handling
1189 * would greatly complicate use of the safe buffer.
1190 */
1191static void *btf_show_obj_safe(struct btf_show *show,
1192			       const struct btf_type *t,
1193			       void *data)
1194{
1195	const struct btf_type *rt;
1196	int size_left, size;
1197	void *safe = NULL;
1198
1199	if (show->flags & BTF_SHOW_UNSAFE)
1200		return data;
1201
1202	rt = btf_resolve_size(show->btf, t, &size);
1203	if (IS_ERR(rt)) {
1204		show->state.status = PTR_ERR(rt);
1205		return NULL;
1206	}
1207
1208	/*
1209	 * Is this toplevel object? If so, set total object size and
1210	 * initialize pointers.  Otherwise check if we still fall within
1211	 * our safe object data.
1212	 */
1213	if (show->state.depth == 0) {
1214		show->obj.size = size;
1215		show->obj.head = data;
1216	} else {
1217		/*
1218		 * If the size of the current object is > our remaining
1219		 * safe buffer we _may_ need to do a new copy.  However
1220		 * consider the case of a nested struct; it's size pushes
1221		 * us over the safe buffer limit, but showing any individual
1222		 * struct members does not.  In such cases, we don't need
1223		 * to initiate a fresh copy yet; however we definitely need
1224		 * at least BTF_SHOW_OBJ_BASE_TYPE_SIZE bytes left
1225		 * in our buffer, regardless of the current object size.
1226		 * The logic here is that as we resolve types we will
1227		 * hit a base type at some point, and we need to be sure
1228		 * the next chunk of data is safely available to display
1229		 * that type info safely.  We cannot rely on the size of
1230		 * the current object here because it may be much larger
1231		 * than our current buffer (e.g. task_struct is 8k).
1232		 * All we want to do here is ensure that we can print the
1233		 * next basic type, which we can if either
1234		 * - the current type size is within the safe buffer; or
1235		 * - at least BTF_SHOW_OBJ_BASE_TYPE_SIZE bytes are left in
1236		 *   the safe buffer.
1237		 */
1238		safe = __btf_show_obj_safe(show, data,
1239					   min(size,
1240					       BTF_SHOW_OBJ_BASE_TYPE_SIZE));
1241	}
1242
1243	/*
1244	 * We need a new copy to our safe object, either because we haven't
1245	 * yet copied and are initializing safe data, or because the data
1246	 * we want falls outside the boundaries of the safe object.
1247	 */
1248	if (!safe) {
1249		size_left = btf_show_obj_size_left(show, data);
1250		if (size_left > BTF_SHOW_OBJ_SAFE_SIZE)
1251			size_left = BTF_SHOW_OBJ_SAFE_SIZE;
1252		show->state.status = copy_from_kernel_nofault(show->obj.safe,
1253							      data, size_left);
1254		if (!show->state.status) {
1255			show->obj.data = data;
1256			safe = show->obj.safe;
1257		}
1258	}
1259
1260	return safe;
1261}
1262
1263/*
1264 * Set the type we are starting to show and return a safe data pointer
1265 * to be used for showing the associated data.
1266 */
1267static void *btf_show_start_type(struct btf_show *show,
1268				 const struct btf_type *t,
1269				 u32 type_id, void *data)
1270{
1271	show->state.type = t;
1272	show->state.type_id = type_id;
1273	show->state.name[0] = '\0';
1274
1275	return btf_show_obj_safe(show, t, data);
1276}
1277
1278static void btf_show_end_type(struct btf_show *show)
1279{
1280	show->state.type = NULL;
1281	show->state.type_id = 0;
1282	show->state.name[0] = '\0';
1283}
1284
1285static void *btf_show_start_aggr_type(struct btf_show *show,
1286				      const struct btf_type *t,
1287				      u32 type_id, void *data)
1288{
1289	void *safe_data = btf_show_start_type(show, t, type_id, data);
1290
1291	if (!safe_data)
1292		return safe_data;
1293
1294	btf_show(show, "%s%s%s", btf_show_indent(show),
1295		 btf_show_name(show),
1296		 btf_show_newline(show));
1297	show->state.depth++;
1298	return safe_data;
1299}
1300
1301static void btf_show_end_aggr_type(struct btf_show *show,
1302				   const char *suffix)
1303{
1304	show->state.depth--;
1305	btf_show(show, "%s%s%s%s", btf_show_indent(show), suffix,
1306		 btf_show_delim(show), btf_show_newline(show));
1307	btf_show_end_type(show);
1308}
1309
1310static void btf_show_start_member(struct btf_show *show,
1311				  const struct btf_member *m)
1312{
1313	show->state.member = m;
1314}
1315
1316static void btf_show_start_array_member(struct btf_show *show)
1317{
1318	show->state.array_member = 1;
1319	btf_show_start_member(show, NULL);
1320}
1321
1322static void btf_show_end_member(struct btf_show *show)
1323{
1324	show->state.member = NULL;
1325}
1326
1327static void btf_show_end_array_member(struct btf_show *show)
1328{
1329	show->state.array_member = 0;
1330	btf_show_end_member(show);
1331}
1332
1333static void *btf_show_start_array_type(struct btf_show *show,
1334				       const struct btf_type *t,
1335				       u32 type_id,
1336				       u16 array_encoding,
1337				       void *data)
1338{
1339	show->state.array_encoding = array_encoding;
1340	show->state.array_terminated = 0;
1341	return btf_show_start_aggr_type(show, t, type_id, data);
1342}
1343
1344static void btf_show_end_array_type(struct btf_show *show)
1345{
1346	show->state.array_encoding = 0;
1347	show->state.array_terminated = 0;
1348	btf_show_end_aggr_type(show, "]");
1349}
1350
1351static void *btf_show_start_struct_type(struct btf_show *show,
1352					const struct btf_type *t,
1353					u32 type_id,
1354					void *data)
1355{
1356	return btf_show_start_aggr_type(show, t, type_id, data);
1357}
1358
1359static void btf_show_end_struct_type(struct btf_show *show)
1360{
1361	btf_show_end_aggr_type(show, "}");
1362}
1363
1364__printf(2, 3) static void __btf_verifier_log(struct bpf_verifier_log *log,
1365					      const char *fmt, ...)
1366{
1367	va_list args;
1368
1369	va_start(args, fmt);
1370	bpf_verifier_vlog(log, fmt, args);
1371	va_end(args);
1372}
1373
1374__printf(2, 3) static void btf_verifier_log(struct btf_verifier_env *env,
1375					    const char *fmt, ...)
1376{
1377	struct bpf_verifier_log *log = &env->log;
1378	va_list args;
1379
1380	if (!bpf_verifier_log_needed(log))
1381		return;
1382
1383	va_start(args, fmt);
1384	bpf_verifier_vlog(log, fmt, args);
1385	va_end(args);
1386}
1387
1388__printf(4, 5) static void __btf_verifier_log_type(struct btf_verifier_env *env,
1389						   const struct btf_type *t,
1390						   bool log_details,
1391						   const char *fmt, ...)
1392{
1393	struct bpf_verifier_log *log = &env->log;
1394	struct btf *btf = env->btf;
1395	va_list args;
1396
1397	if (!bpf_verifier_log_needed(log))
1398		return;
1399
1400	/* btf verifier prints all types it is processing via
1401	 * btf_verifier_log_type(..., fmt = NULL).
1402	 * Skip those prints for in-kernel BTF verification.
1403	 */
1404	if (log->level == BPF_LOG_KERNEL && !fmt)
1405		return;
 
 
 
 
 
 
1406
1407	__btf_verifier_log(log, "[%u] %s %s%s",
1408			   env->log_type_id,
1409			   btf_type_str(t),
1410			   __btf_name_by_offset(btf, t->name_off),
1411			   log_details ? " " : "");
1412
1413	if (log_details)
1414		btf_type_ops(t)->log_details(env, t);
1415
1416	if (fmt && *fmt) {
1417		__btf_verifier_log(log, " ");
1418		va_start(args, fmt);
1419		bpf_verifier_vlog(log, fmt, args);
1420		va_end(args);
1421	}
1422
1423	__btf_verifier_log(log, "\n");
1424}
1425
1426#define btf_verifier_log_type(env, t, ...) \
1427	__btf_verifier_log_type((env), (t), true, __VA_ARGS__)
1428#define btf_verifier_log_basic(env, t, ...) \
1429	__btf_verifier_log_type((env), (t), false, __VA_ARGS__)
1430
1431__printf(4, 5)
1432static void btf_verifier_log_member(struct btf_verifier_env *env,
1433				    const struct btf_type *struct_type,
1434				    const struct btf_member *member,
1435				    const char *fmt, ...)
1436{
1437	struct bpf_verifier_log *log = &env->log;
1438	struct btf *btf = env->btf;
1439	va_list args;
1440
1441	if (!bpf_verifier_log_needed(log))
1442		return;
1443
1444	if (log->level == BPF_LOG_KERNEL && !fmt)
1445		return;
 
 
 
 
 
 
 
1446	/* The CHECK_META phase already did a btf dump.
1447	 *
1448	 * If member is logged again, it must hit an error in
1449	 * parsing this member.  It is useful to print out which
1450	 * struct this member belongs to.
1451	 */
1452	if (env->phase != CHECK_META)
1453		btf_verifier_log_type(env, struct_type, NULL);
1454
1455	if (btf_type_kflag(struct_type))
1456		__btf_verifier_log(log,
1457				   "\t%s type_id=%u bitfield_size=%u bits_offset=%u",
1458				   __btf_name_by_offset(btf, member->name_off),
1459				   member->type,
1460				   BTF_MEMBER_BITFIELD_SIZE(member->offset),
1461				   BTF_MEMBER_BIT_OFFSET(member->offset));
1462	else
1463		__btf_verifier_log(log, "\t%s type_id=%u bits_offset=%u",
1464				   __btf_name_by_offset(btf, member->name_off),
1465				   member->type, member->offset);
1466
1467	if (fmt && *fmt) {
1468		__btf_verifier_log(log, " ");
1469		va_start(args, fmt);
1470		bpf_verifier_vlog(log, fmt, args);
1471		va_end(args);
1472	}
1473
1474	__btf_verifier_log(log, "\n");
1475}
1476
1477__printf(4, 5)
1478static void btf_verifier_log_vsi(struct btf_verifier_env *env,
1479				 const struct btf_type *datasec_type,
1480				 const struct btf_var_secinfo *vsi,
1481				 const char *fmt, ...)
1482{
1483	struct bpf_verifier_log *log = &env->log;
1484	va_list args;
1485
1486	if (!bpf_verifier_log_needed(log))
1487		return;
1488	if (log->level == BPF_LOG_KERNEL && !fmt)
1489		return;
1490	if (env->phase != CHECK_META)
1491		btf_verifier_log_type(env, datasec_type, NULL);
1492
1493	__btf_verifier_log(log, "\t type_id=%u offset=%u size=%u",
1494			   vsi->type, vsi->offset, vsi->size);
1495	if (fmt && *fmt) {
1496		__btf_verifier_log(log, " ");
1497		va_start(args, fmt);
1498		bpf_verifier_vlog(log, fmt, args);
1499		va_end(args);
1500	}
1501
1502	__btf_verifier_log(log, "\n");
1503}
1504
1505static void btf_verifier_log_hdr(struct btf_verifier_env *env,
1506				 u32 btf_data_size)
1507{
1508	struct bpf_verifier_log *log = &env->log;
1509	const struct btf *btf = env->btf;
1510	const struct btf_header *hdr;
1511
1512	if (!bpf_verifier_log_needed(log))
1513		return;
1514
1515	if (log->level == BPF_LOG_KERNEL)
1516		return;
1517	hdr = &btf->hdr;
1518	__btf_verifier_log(log, "magic: 0x%x\n", hdr->magic);
1519	__btf_verifier_log(log, "version: %u\n", hdr->version);
1520	__btf_verifier_log(log, "flags: 0x%x\n", hdr->flags);
1521	__btf_verifier_log(log, "hdr_len: %u\n", hdr->hdr_len);
1522	__btf_verifier_log(log, "type_off: %u\n", hdr->type_off);
1523	__btf_verifier_log(log, "type_len: %u\n", hdr->type_len);
1524	__btf_verifier_log(log, "str_off: %u\n", hdr->str_off);
1525	__btf_verifier_log(log, "str_len: %u\n", hdr->str_len);
1526	__btf_verifier_log(log, "btf_total_size: %u\n", btf_data_size);
1527}
1528
1529static int btf_add_type(struct btf_verifier_env *env, struct btf_type *t)
1530{
1531	struct btf *btf = env->btf;
1532
1533	if (btf->types_size == btf->nr_types) {
1534		/* Expand 'types' array */
1535
1536		struct btf_type **new_types;
1537		u32 expand_by, new_size;
1538
1539		if (btf->start_id + btf->types_size == BTF_MAX_TYPE) {
1540			btf_verifier_log(env, "Exceeded max num of types");
1541			return -E2BIG;
1542		}
1543
1544		expand_by = max_t(u32, btf->types_size >> 2, 16);
1545		new_size = min_t(u32, BTF_MAX_TYPE,
1546				 btf->types_size + expand_by);
1547
1548		new_types = kvcalloc(new_size, sizeof(*new_types),
1549				     GFP_KERNEL | __GFP_NOWARN);
1550		if (!new_types)
1551			return -ENOMEM;
1552
1553		if (btf->nr_types == 0) {
1554			if (!btf->base_btf) {
1555				/* lazily init VOID type */
1556				new_types[0] = &btf_void;
1557				btf->nr_types++;
1558			}
1559		} else {
1560			memcpy(new_types, btf->types,
1561			       sizeof(*btf->types) * btf->nr_types);
1562		}
1563
1564		kvfree(btf->types);
1565		btf->types = new_types;
1566		btf->types_size = new_size;
1567	}
1568
1569	btf->types[btf->nr_types++] = t;
1570
1571	return 0;
1572}
1573
1574static int btf_alloc_id(struct btf *btf)
1575{
1576	int id;
1577
1578	idr_preload(GFP_KERNEL);
1579	spin_lock_bh(&btf_idr_lock);
1580	id = idr_alloc_cyclic(&btf_idr, btf, 1, INT_MAX, GFP_ATOMIC);
1581	if (id > 0)
1582		btf->id = id;
1583	spin_unlock_bh(&btf_idr_lock);
1584	idr_preload_end();
1585
1586	if (WARN_ON_ONCE(!id))
1587		return -ENOSPC;
1588
1589	return id > 0 ? 0 : id;
1590}
1591
1592static void btf_free_id(struct btf *btf)
1593{
1594	unsigned long flags;
1595
1596	/*
1597	 * In map-in-map, calling map_delete_elem() on outer
1598	 * map will call bpf_map_put on the inner map.
1599	 * It will then eventually call btf_free_id()
1600	 * on the inner map.  Some of the map_delete_elem()
1601	 * implementation may have irq disabled, so
1602	 * we need to use the _irqsave() version instead
1603	 * of the _bh() version.
1604	 */
1605	spin_lock_irqsave(&btf_idr_lock, flags);
1606	idr_remove(&btf_idr, btf->id);
1607	spin_unlock_irqrestore(&btf_idr_lock, flags);
1608}
1609
1610static void btf_free_kfunc_set_tab(struct btf *btf)
1611{
1612	struct btf_kfunc_set_tab *tab = btf->kfunc_set_tab;
1613	int hook;
1614
1615	if (!tab)
1616		return;
1617	/* For module BTF, we directly assign the sets being registered, so
1618	 * there is nothing to free except kfunc_set_tab.
1619	 */
1620	if (btf_is_module(btf))
1621		goto free_tab;
1622	for (hook = 0; hook < ARRAY_SIZE(tab->sets); hook++)
1623		kfree(tab->sets[hook]);
1624free_tab:
1625	kfree(tab);
1626	btf->kfunc_set_tab = NULL;
1627}
1628
1629static void btf_free_dtor_kfunc_tab(struct btf *btf)
1630{
1631	struct btf_id_dtor_kfunc_tab *tab = btf->dtor_kfunc_tab;
1632
1633	if (!tab)
1634		return;
1635	kfree(tab);
1636	btf->dtor_kfunc_tab = NULL;
1637}
1638
1639static void btf_struct_metas_free(struct btf_struct_metas *tab)
1640{
1641	int i;
1642
1643	if (!tab)
1644		return;
1645	for (i = 0; i < tab->cnt; i++) {
1646		btf_record_free(tab->types[i].record);
1647		kfree(tab->types[i].field_offs);
1648	}
1649	kfree(tab);
1650}
1651
1652static void btf_free_struct_meta_tab(struct btf *btf)
1653{
1654	struct btf_struct_metas *tab = btf->struct_meta_tab;
1655
1656	btf_struct_metas_free(tab);
1657	btf->struct_meta_tab = NULL;
1658}
1659
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1660static void btf_free(struct btf *btf)
1661{
1662	btf_free_struct_meta_tab(btf);
1663	btf_free_dtor_kfunc_tab(btf);
1664	btf_free_kfunc_set_tab(btf);
 
1665	kvfree(btf->types);
1666	kvfree(btf->resolved_sizes);
1667	kvfree(btf->resolved_ids);
1668	kvfree(btf->data);
 
 
 
 
 
1669	kfree(btf);
1670}
1671
1672static void btf_free_rcu(struct rcu_head *rcu)
1673{
1674	struct btf *btf = container_of(rcu, struct btf, rcu);
1675
1676	btf_free(btf);
1677}
1678
 
 
 
 
 
1679void btf_get(struct btf *btf)
1680{
1681	refcount_inc(&btf->refcnt);
1682}
1683
1684void btf_put(struct btf *btf)
1685{
1686	if (btf && refcount_dec_and_test(&btf->refcnt)) {
1687		btf_free_id(btf);
1688		call_rcu(&btf->rcu, btf_free_rcu);
1689	}
1690}
1691
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1692static int env_resolve_init(struct btf_verifier_env *env)
1693{
1694	struct btf *btf = env->btf;
1695	u32 nr_types = btf->nr_types;
1696	u32 *resolved_sizes = NULL;
1697	u32 *resolved_ids = NULL;
1698	u8 *visit_states = NULL;
1699
1700	resolved_sizes = kvcalloc(nr_types, sizeof(*resolved_sizes),
1701				  GFP_KERNEL | __GFP_NOWARN);
1702	if (!resolved_sizes)
1703		goto nomem;
1704
1705	resolved_ids = kvcalloc(nr_types, sizeof(*resolved_ids),
1706				GFP_KERNEL | __GFP_NOWARN);
1707	if (!resolved_ids)
1708		goto nomem;
1709
1710	visit_states = kvcalloc(nr_types, sizeof(*visit_states),
1711				GFP_KERNEL | __GFP_NOWARN);
1712	if (!visit_states)
1713		goto nomem;
1714
1715	btf->resolved_sizes = resolved_sizes;
1716	btf->resolved_ids = resolved_ids;
1717	env->visit_states = visit_states;
1718
1719	return 0;
1720
1721nomem:
1722	kvfree(resolved_sizes);
1723	kvfree(resolved_ids);
1724	kvfree(visit_states);
1725	return -ENOMEM;
1726}
1727
1728static void btf_verifier_env_free(struct btf_verifier_env *env)
1729{
1730	kvfree(env->visit_states);
1731	kfree(env);
1732}
1733
1734static bool env_type_is_resolve_sink(const struct btf_verifier_env *env,
1735				     const struct btf_type *next_type)
1736{
1737	switch (env->resolve_mode) {
1738	case RESOLVE_TBD:
1739		/* int, enum or void is a sink */
1740		return !btf_type_needs_resolve(next_type);
1741	case RESOLVE_PTR:
1742		/* int, enum, void, struct, array, func or func_proto is a sink
1743		 * for ptr
1744		 */
1745		return !btf_type_is_modifier(next_type) &&
1746			!btf_type_is_ptr(next_type);
1747	case RESOLVE_STRUCT_OR_ARRAY:
1748		/* int, enum, void, ptr, func or func_proto is a sink
1749		 * for struct and array
1750		 */
1751		return !btf_type_is_modifier(next_type) &&
1752			!btf_type_is_array(next_type) &&
1753			!btf_type_is_struct(next_type);
1754	default:
1755		BUG();
1756	}
1757}
1758
1759static bool env_type_is_resolved(const struct btf_verifier_env *env,
1760				 u32 type_id)
1761{
1762	/* base BTF types should be resolved by now */
1763	if (type_id < env->btf->start_id)
1764		return true;
1765
1766	return env->visit_states[type_id - env->btf->start_id] == RESOLVED;
1767}
1768
1769static int env_stack_push(struct btf_verifier_env *env,
1770			  const struct btf_type *t, u32 type_id)
1771{
1772	const struct btf *btf = env->btf;
1773	struct resolve_vertex *v;
1774
1775	if (env->top_stack == MAX_RESOLVE_DEPTH)
1776		return -E2BIG;
1777
1778	if (type_id < btf->start_id
1779	    || env->visit_states[type_id - btf->start_id] != NOT_VISITED)
1780		return -EEXIST;
1781
1782	env->visit_states[type_id - btf->start_id] = VISITED;
1783
1784	v = &env->stack[env->top_stack++];
1785	v->t = t;
1786	v->type_id = type_id;
1787	v->next_member = 0;
1788
1789	if (env->resolve_mode == RESOLVE_TBD) {
1790		if (btf_type_is_ptr(t))
1791			env->resolve_mode = RESOLVE_PTR;
1792		else if (btf_type_is_struct(t) || btf_type_is_array(t))
1793			env->resolve_mode = RESOLVE_STRUCT_OR_ARRAY;
1794	}
1795
1796	return 0;
1797}
1798
1799static void env_stack_set_next_member(struct btf_verifier_env *env,
1800				      u16 next_member)
1801{
1802	env->stack[env->top_stack - 1].next_member = next_member;
1803}
1804
1805static void env_stack_pop_resolved(struct btf_verifier_env *env,
1806				   u32 resolved_type_id,
1807				   u32 resolved_size)
1808{
1809	u32 type_id = env->stack[--(env->top_stack)].type_id;
1810	struct btf *btf = env->btf;
1811
1812	type_id -= btf->start_id; /* adjust to local type id */
1813	btf->resolved_sizes[type_id] = resolved_size;
1814	btf->resolved_ids[type_id] = resolved_type_id;
1815	env->visit_states[type_id] = RESOLVED;
1816}
1817
1818static const struct resolve_vertex *env_stack_peak(struct btf_verifier_env *env)
1819{
1820	return env->top_stack ? &env->stack[env->top_stack - 1] : NULL;
1821}
1822
1823/* Resolve the size of a passed-in "type"
1824 *
1825 * type: is an array (e.g. u32 array[x][y])
1826 * return type: type "u32[x][y]", i.e. BTF_KIND_ARRAY,
1827 * *type_size: (x * y * sizeof(u32)).  Hence, *type_size always
1828 *             corresponds to the return type.
1829 * *elem_type: u32
1830 * *elem_id: id of u32
1831 * *total_nelems: (x * y).  Hence, individual elem size is
1832 *                (*type_size / *total_nelems)
1833 * *type_id: id of type if it's changed within the function, 0 if not
1834 *
1835 * type: is not an array (e.g. const struct X)
1836 * return type: type "struct X"
1837 * *type_size: sizeof(struct X)
1838 * *elem_type: same as return type ("struct X")
1839 * *elem_id: 0
1840 * *total_nelems: 1
1841 * *type_id: id of type if it's changed within the function, 0 if not
1842 */
1843static const struct btf_type *
1844__btf_resolve_size(const struct btf *btf, const struct btf_type *type,
1845		   u32 *type_size, const struct btf_type **elem_type,
1846		   u32 *elem_id, u32 *total_nelems, u32 *type_id)
1847{
1848	const struct btf_type *array_type = NULL;
1849	const struct btf_array *array = NULL;
1850	u32 i, size, nelems = 1, id = 0;
1851
1852	for (i = 0; i < MAX_RESOLVE_DEPTH; i++) {
1853		switch (BTF_INFO_KIND(type->info)) {
1854		/* type->size can be used */
1855		case BTF_KIND_INT:
1856		case BTF_KIND_STRUCT:
1857		case BTF_KIND_UNION:
1858		case BTF_KIND_ENUM:
1859		case BTF_KIND_FLOAT:
1860		case BTF_KIND_ENUM64:
1861			size = type->size;
1862			goto resolved;
1863
1864		case BTF_KIND_PTR:
1865			size = sizeof(void *);
1866			goto resolved;
1867
1868		/* Modifiers */
1869		case BTF_KIND_TYPEDEF:
1870		case BTF_KIND_VOLATILE:
1871		case BTF_KIND_CONST:
1872		case BTF_KIND_RESTRICT:
1873		case BTF_KIND_TYPE_TAG:
1874			id = type->type;
1875			type = btf_type_by_id(btf, type->type);
1876			break;
1877
1878		case BTF_KIND_ARRAY:
1879			if (!array_type)
1880				array_type = type;
1881			array = btf_type_array(type);
1882			if (nelems && array->nelems > U32_MAX / nelems)
1883				return ERR_PTR(-EINVAL);
1884			nelems *= array->nelems;
1885			type = btf_type_by_id(btf, array->type);
1886			break;
1887
1888		/* type without size */
1889		default:
1890			return ERR_PTR(-EINVAL);
1891		}
1892	}
1893
1894	return ERR_PTR(-EINVAL);
1895
1896resolved:
1897	if (nelems && size > U32_MAX / nelems)
1898		return ERR_PTR(-EINVAL);
1899
1900	*type_size = nelems * size;
1901	if (total_nelems)
1902		*total_nelems = nelems;
1903	if (elem_type)
1904		*elem_type = type;
1905	if (elem_id)
1906		*elem_id = array ? array->type : 0;
1907	if (type_id && id)
1908		*type_id = id;
1909
1910	return array_type ? : type;
1911}
1912
1913const struct btf_type *
1914btf_resolve_size(const struct btf *btf, const struct btf_type *type,
1915		 u32 *type_size)
1916{
1917	return __btf_resolve_size(btf, type, type_size, NULL, NULL, NULL, NULL);
1918}
1919
1920static u32 btf_resolved_type_id(const struct btf *btf, u32 type_id)
1921{
1922	while (type_id < btf->start_id)
1923		btf = btf->base_btf;
1924
1925	return btf->resolved_ids[type_id - btf->start_id];
1926}
1927
1928/* The input param "type_id" must point to a needs_resolve type */
1929static const struct btf_type *btf_type_id_resolve(const struct btf *btf,
1930						  u32 *type_id)
1931{
1932	*type_id = btf_resolved_type_id(btf, *type_id);
1933	return btf_type_by_id(btf, *type_id);
1934}
1935
1936static u32 btf_resolved_type_size(const struct btf *btf, u32 type_id)
1937{
1938	while (type_id < btf->start_id)
1939		btf = btf->base_btf;
1940
1941	return btf->resolved_sizes[type_id - btf->start_id];
1942}
1943
1944const struct btf_type *btf_type_id_size(const struct btf *btf,
1945					u32 *type_id, u32 *ret_size)
1946{
1947	const struct btf_type *size_type;
1948	u32 size_type_id = *type_id;
1949	u32 size = 0;
1950
1951	size_type = btf_type_by_id(btf, size_type_id);
1952	if (btf_type_nosize_or_null(size_type))
1953		return NULL;
1954
1955	if (btf_type_has_size(size_type)) {
1956		size = size_type->size;
1957	} else if (btf_type_is_array(size_type)) {
1958		size = btf_resolved_type_size(btf, size_type_id);
1959	} else if (btf_type_is_ptr(size_type)) {
1960		size = sizeof(void *);
1961	} else {
1962		if (WARN_ON_ONCE(!btf_type_is_modifier(size_type) &&
1963				 !btf_type_is_var(size_type)))
1964			return NULL;
1965
1966		size_type_id = btf_resolved_type_id(btf, size_type_id);
1967		size_type = btf_type_by_id(btf, size_type_id);
1968		if (btf_type_nosize_or_null(size_type))
1969			return NULL;
1970		else if (btf_type_has_size(size_type))
1971			size = size_type->size;
1972		else if (btf_type_is_array(size_type))
1973			size = btf_resolved_type_size(btf, size_type_id);
1974		else if (btf_type_is_ptr(size_type))
1975			size = sizeof(void *);
1976		else
1977			return NULL;
1978	}
1979
1980	*type_id = size_type_id;
1981	if (ret_size)
1982		*ret_size = size;
1983
1984	return size_type;
1985}
1986
1987static int btf_df_check_member(struct btf_verifier_env *env,
1988			       const struct btf_type *struct_type,
1989			       const struct btf_member *member,
1990			       const struct btf_type *member_type)
1991{
1992	btf_verifier_log_basic(env, struct_type,
1993			       "Unsupported check_member");
1994	return -EINVAL;
1995}
1996
1997static int btf_df_check_kflag_member(struct btf_verifier_env *env,
1998				     const struct btf_type *struct_type,
1999				     const struct btf_member *member,
2000				     const struct btf_type *member_type)
2001{
2002	btf_verifier_log_basic(env, struct_type,
2003			       "Unsupported check_kflag_member");
2004	return -EINVAL;
2005}
2006
2007/* Used for ptr, array struct/union and float type members.
2008 * int, enum and modifier types have their specific callback functions.
2009 */
2010static int btf_generic_check_kflag_member(struct btf_verifier_env *env,
2011					  const struct btf_type *struct_type,
2012					  const struct btf_member *member,
2013					  const struct btf_type *member_type)
2014{
2015	if (BTF_MEMBER_BITFIELD_SIZE(member->offset)) {
2016		btf_verifier_log_member(env, struct_type, member,
2017					"Invalid member bitfield_size");
2018		return -EINVAL;
2019	}
2020
2021	/* bitfield size is 0, so member->offset represents bit offset only.
2022	 * It is safe to call non kflag check_member variants.
2023	 */
2024	return btf_type_ops(member_type)->check_member(env, struct_type,
2025						       member,
2026						       member_type);
2027}
2028
2029static int btf_df_resolve(struct btf_verifier_env *env,
2030			  const struct resolve_vertex *v)
2031{
2032	btf_verifier_log_basic(env, v->t, "Unsupported resolve");
2033	return -EINVAL;
2034}
2035
2036static void btf_df_show(const struct btf *btf, const struct btf_type *t,
2037			u32 type_id, void *data, u8 bits_offsets,
2038			struct btf_show *show)
2039{
2040	btf_show(show, "<unsupported kind:%u>", BTF_INFO_KIND(t->info));
2041}
2042
2043static int btf_int_check_member(struct btf_verifier_env *env,
2044				const struct btf_type *struct_type,
2045				const struct btf_member *member,
2046				const struct btf_type *member_type)
2047{
2048	u32 int_data = btf_type_int(member_type);
2049	u32 struct_bits_off = member->offset;
2050	u32 struct_size = struct_type->size;
2051	u32 nr_copy_bits;
2052	u32 bytes_offset;
2053
2054	if (U32_MAX - struct_bits_off < BTF_INT_OFFSET(int_data)) {
2055		btf_verifier_log_member(env, struct_type, member,
2056					"bits_offset exceeds U32_MAX");
2057		return -EINVAL;
2058	}
2059
2060	struct_bits_off += BTF_INT_OFFSET(int_data);
2061	bytes_offset = BITS_ROUNDDOWN_BYTES(struct_bits_off);
2062	nr_copy_bits = BTF_INT_BITS(int_data) +
2063		BITS_PER_BYTE_MASKED(struct_bits_off);
2064
2065	if (nr_copy_bits > BITS_PER_U128) {
2066		btf_verifier_log_member(env, struct_type, member,
2067					"nr_copy_bits exceeds 128");
2068		return -EINVAL;
2069	}
2070
2071	if (struct_size < bytes_offset ||
2072	    struct_size - bytes_offset < BITS_ROUNDUP_BYTES(nr_copy_bits)) {
2073		btf_verifier_log_member(env, struct_type, member,
2074					"Member exceeds struct_size");
2075		return -EINVAL;
2076	}
2077
2078	return 0;
2079}
2080
2081static int btf_int_check_kflag_member(struct btf_verifier_env *env,
2082				      const struct btf_type *struct_type,
2083				      const struct btf_member *member,
2084				      const struct btf_type *member_type)
2085{
2086	u32 struct_bits_off, nr_bits, nr_int_data_bits, bytes_offset;
2087	u32 int_data = btf_type_int(member_type);
2088	u32 struct_size = struct_type->size;
2089	u32 nr_copy_bits;
2090
2091	/* a regular int type is required for the kflag int member */
2092	if (!btf_type_int_is_regular(member_type)) {
2093		btf_verifier_log_member(env, struct_type, member,
2094					"Invalid member base type");
2095		return -EINVAL;
2096	}
2097
2098	/* check sanity of bitfield size */
2099	nr_bits = BTF_MEMBER_BITFIELD_SIZE(member->offset);
2100	struct_bits_off = BTF_MEMBER_BIT_OFFSET(member->offset);
2101	nr_int_data_bits = BTF_INT_BITS(int_data);
2102	if (!nr_bits) {
2103		/* Not a bitfield member, member offset must be at byte
2104		 * boundary.
2105		 */
2106		if (BITS_PER_BYTE_MASKED(struct_bits_off)) {
2107			btf_verifier_log_member(env, struct_type, member,
2108						"Invalid member offset");
2109			return -EINVAL;
2110		}
2111
2112		nr_bits = nr_int_data_bits;
2113	} else if (nr_bits > nr_int_data_bits) {
2114		btf_verifier_log_member(env, struct_type, member,
2115					"Invalid member bitfield_size");
2116		return -EINVAL;
2117	}
2118
2119	bytes_offset = BITS_ROUNDDOWN_BYTES(struct_bits_off);
2120	nr_copy_bits = nr_bits + BITS_PER_BYTE_MASKED(struct_bits_off);
2121	if (nr_copy_bits > BITS_PER_U128) {
2122		btf_verifier_log_member(env, struct_type, member,
2123					"nr_copy_bits exceeds 128");
2124		return -EINVAL;
2125	}
2126
2127	if (struct_size < bytes_offset ||
2128	    struct_size - bytes_offset < BITS_ROUNDUP_BYTES(nr_copy_bits)) {
2129		btf_verifier_log_member(env, struct_type, member,
2130					"Member exceeds struct_size");
2131		return -EINVAL;
2132	}
2133
2134	return 0;
2135}
2136
2137static s32 btf_int_check_meta(struct btf_verifier_env *env,
2138			      const struct btf_type *t,
2139			      u32 meta_left)
2140{
2141	u32 int_data, nr_bits, meta_needed = sizeof(int_data);
2142	u16 encoding;
2143
2144	if (meta_left < meta_needed) {
2145		btf_verifier_log_basic(env, t,
2146				       "meta_left:%u meta_needed:%u",
2147				       meta_left, meta_needed);
2148		return -EINVAL;
2149	}
2150
2151	if (btf_type_vlen(t)) {
2152		btf_verifier_log_type(env, t, "vlen != 0");
2153		return -EINVAL;
2154	}
2155
2156	if (btf_type_kflag(t)) {
2157		btf_verifier_log_type(env, t, "Invalid btf_info kind_flag");
2158		return -EINVAL;
2159	}
2160
2161	int_data = btf_type_int(t);
2162	if (int_data & ~BTF_INT_MASK) {
2163		btf_verifier_log_basic(env, t, "Invalid int_data:%x",
2164				       int_data);
2165		return -EINVAL;
2166	}
2167
2168	nr_bits = BTF_INT_BITS(int_data) + BTF_INT_OFFSET(int_data);
2169
2170	if (nr_bits > BITS_PER_U128) {
2171		btf_verifier_log_type(env, t, "nr_bits exceeds %zu",
2172				      BITS_PER_U128);
2173		return -EINVAL;
2174	}
2175
2176	if (BITS_ROUNDUP_BYTES(nr_bits) > t->size) {
2177		btf_verifier_log_type(env, t, "nr_bits exceeds type_size");
2178		return -EINVAL;
2179	}
2180
2181	/*
2182	 * Only one of the encoding bits is allowed and it
2183	 * should be sufficient for the pretty print purpose (i.e. decoding).
2184	 * Multiple bits can be allowed later if it is found
2185	 * to be insufficient.
2186	 */
2187	encoding = BTF_INT_ENCODING(int_data);
2188	if (encoding &&
2189	    encoding != BTF_INT_SIGNED &&
2190	    encoding != BTF_INT_CHAR &&
2191	    encoding != BTF_INT_BOOL) {
2192		btf_verifier_log_type(env, t, "Unsupported encoding");
2193		return -ENOTSUPP;
2194	}
2195
2196	btf_verifier_log_type(env, t, NULL);
2197
2198	return meta_needed;
2199}
2200
2201static void btf_int_log(struct btf_verifier_env *env,
2202			const struct btf_type *t)
2203{
2204	int int_data = btf_type_int(t);
2205
2206	btf_verifier_log(env,
2207			 "size=%u bits_offset=%u nr_bits=%u encoding=%s",
2208			 t->size, BTF_INT_OFFSET(int_data),
2209			 BTF_INT_BITS(int_data),
2210			 btf_int_encoding_str(BTF_INT_ENCODING(int_data)));
2211}
2212
2213static void btf_int128_print(struct btf_show *show, void *data)
2214{
2215	/* data points to a __int128 number.
2216	 * Suppose
2217	 *     int128_num = *(__int128 *)data;
2218	 * The below formulas shows what upper_num and lower_num represents:
2219	 *     upper_num = int128_num >> 64;
2220	 *     lower_num = int128_num & 0xffffffffFFFFFFFFULL;
2221	 */
2222	u64 upper_num, lower_num;
2223
2224#ifdef __BIG_ENDIAN_BITFIELD
2225	upper_num = *(u64 *)data;
2226	lower_num = *(u64 *)(data + 8);
2227#else
2228	upper_num = *(u64 *)(data + 8);
2229	lower_num = *(u64 *)data;
2230#endif
2231	if (upper_num == 0)
2232		btf_show_type_value(show, "0x%llx", lower_num);
2233	else
2234		btf_show_type_values(show, "0x%llx%016llx", upper_num,
2235				     lower_num);
2236}
2237
2238static void btf_int128_shift(u64 *print_num, u16 left_shift_bits,
2239			     u16 right_shift_bits)
2240{
2241	u64 upper_num, lower_num;
2242
2243#ifdef __BIG_ENDIAN_BITFIELD
2244	upper_num = print_num[0];
2245	lower_num = print_num[1];
2246#else
2247	upper_num = print_num[1];
2248	lower_num = print_num[0];
2249#endif
2250
2251	/* shake out un-needed bits by shift/or operations */
2252	if (left_shift_bits >= 64) {
2253		upper_num = lower_num << (left_shift_bits - 64);
2254		lower_num = 0;
2255	} else {
2256		upper_num = (upper_num << left_shift_bits) |
2257			    (lower_num >> (64 - left_shift_bits));
2258		lower_num = lower_num << left_shift_bits;
2259	}
2260
2261	if (right_shift_bits >= 64) {
2262		lower_num = upper_num >> (right_shift_bits - 64);
2263		upper_num = 0;
2264	} else {
2265		lower_num = (lower_num >> right_shift_bits) |
2266			    (upper_num << (64 - right_shift_bits));
2267		upper_num = upper_num >> right_shift_bits;
2268	}
2269
2270#ifdef __BIG_ENDIAN_BITFIELD
2271	print_num[0] = upper_num;
2272	print_num[1] = lower_num;
2273#else
2274	print_num[0] = lower_num;
2275	print_num[1] = upper_num;
2276#endif
2277}
2278
2279static void btf_bitfield_show(void *data, u8 bits_offset,
2280			      u8 nr_bits, struct btf_show *show)
2281{
2282	u16 left_shift_bits, right_shift_bits;
2283	u8 nr_copy_bytes;
2284	u8 nr_copy_bits;
2285	u64 print_num[2] = {};
2286
2287	nr_copy_bits = nr_bits + bits_offset;
2288	nr_copy_bytes = BITS_ROUNDUP_BYTES(nr_copy_bits);
2289
2290	memcpy(print_num, data, nr_copy_bytes);
2291
2292#ifdef __BIG_ENDIAN_BITFIELD
2293	left_shift_bits = bits_offset;
2294#else
2295	left_shift_bits = BITS_PER_U128 - nr_copy_bits;
2296#endif
2297	right_shift_bits = BITS_PER_U128 - nr_bits;
2298
2299	btf_int128_shift(print_num, left_shift_bits, right_shift_bits);
2300	btf_int128_print(show, print_num);
2301}
2302
2303
2304static void btf_int_bits_show(const struct btf *btf,
2305			      const struct btf_type *t,
2306			      void *data, u8 bits_offset,
2307			      struct btf_show *show)
2308{
2309	u32 int_data = btf_type_int(t);
2310	u8 nr_bits = BTF_INT_BITS(int_data);
2311	u8 total_bits_offset;
2312
2313	/*
2314	 * bits_offset is at most 7.
2315	 * BTF_INT_OFFSET() cannot exceed 128 bits.
2316	 */
2317	total_bits_offset = bits_offset + BTF_INT_OFFSET(int_data);
2318	data += BITS_ROUNDDOWN_BYTES(total_bits_offset);
2319	bits_offset = BITS_PER_BYTE_MASKED(total_bits_offset);
2320	btf_bitfield_show(data, bits_offset, nr_bits, show);
2321}
2322
2323static void btf_int_show(const struct btf *btf, const struct btf_type *t,
2324			 u32 type_id, void *data, u8 bits_offset,
2325			 struct btf_show *show)
2326{
2327	u32 int_data = btf_type_int(t);
2328	u8 encoding = BTF_INT_ENCODING(int_data);
2329	bool sign = encoding & BTF_INT_SIGNED;
2330	u8 nr_bits = BTF_INT_BITS(int_data);
2331	void *safe_data;
2332
2333	safe_data = btf_show_start_type(show, t, type_id, data);
2334	if (!safe_data)
2335		return;
2336
2337	if (bits_offset || BTF_INT_OFFSET(int_data) ||
2338	    BITS_PER_BYTE_MASKED(nr_bits)) {
2339		btf_int_bits_show(btf, t, safe_data, bits_offset, show);
2340		goto out;
2341	}
2342
2343	switch (nr_bits) {
2344	case 128:
2345		btf_int128_print(show, safe_data);
2346		break;
2347	case 64:
2348		if (sign)
2349			btf_show_type_value(show, "%lld", *(s64 *)safe_data);
2350		else
2351			btf_show_type_value(show, "%llu", *(u64 *)safe_data);
2352		break;
2353	case 32:
2354		if (sign)
2355			btf_show_type_value(show, "%d", *(s32 *)safe_data);
2356		else
2357			btf_show_type_value(show, "%u", *(u32 *)safe_data);
2358		break;
2359	case 16:
2360		if (sign)
2361			btf_show_type_value(show, "%d", *(s16 *)safe_data);
2362		else
2363			btf_show_type_value(show, "%u", *(u16 *)safe_data);
2364		break;
2365	case 8:
2366		if (show->state.array_encoding == BTF_INT_CHAR) {
2367			/* check for null terminator */
2368			if (show->state.array_terminated)
2369				break;
2370			if (*(char *)data == '\0') {
2371				show->state.array_terminated = 1;
2372				break;
2373			}
2374			if (isprint(*(char *)data)) {
2375				btf_show_type_value(show, "'%c'",
2376						    *(char *)safe_data);
2377				break;
2378			}
2379		}
2380		if (sign)
2381			btf_show_type_value(show, "%d", *(s8 *)safe_data);
2382		else
2383			btf_show_type_value(show, "%u", *(u8 *)safe_data);
2384		break;
2385	default:
2386		btf_int_bits_show(btf, t, safe_data, bits_offset, show);
2387		break;
2388	}
2389out:
2390	btf_show_end_type(show);
2391}
2392
2393static const struct btf_kind_operations int_ops = {
2394	.check_meta = btf_int_check_meta,
2395	.resolve = btf_df_resolve,
2396	.check_member = btf_int_check_member,
2397	.check_kflag_member = btf_int_check_kflag_member,
2398	.log_details = btf_int_log,
2399	.show = btf_int_show,
2400};
2401
2402static int btf_modifier_check_member(struct btf_verifier_env *env,
2403				     const struct btf_type *struct_type,
2404				     const struct btf_member *member,
2405				     const struct btf_type *member_type)
2406{
2407	const struct btf_type *resolved_type;
2408	u32 resolved_type_id = member->type;
2409	struct btf_member resolved_member;
2410	struct btf *btf = env->btf;
2411
2412	resolved_type = btf_type_id_size(btf, &resolved_type_id, NULL);
2413	if (!resolved_type) {
2414		btf_verifier_log_member(env, struct_type, member,
2415					"Invalid member");
2416		return -EINVAL;
2417	}
2418
2419	resolved_member = *member;
2420	resolved_member.type = resolved_type_id;
2421
2422	return btf_type_ops(resolved_type)->check_member(env, struct_type,
2423							 &resolved_member,
2424							 resolved_type);
2425}
2426
2427static int btf_modifier_check_kflag_member(struct btf_verifier_env *env,
2428					   const struct btf_type *struct_type,
2429					   const struct btf_member *member,
2430					   const struct btf_type *member_type)
2431{
2432	const struct btf_type *resolved_type;
2433	u32 resolved_type_id = member->type;
2434	struct btf_member resolved_member;
2435	struct btf *btf = env->btf;
2436
2437	resolved_type = btf_type_id_size(btf, &resolved_type_id, NULL);
2438	if (!resolved_type) {
2439		btf_verifier_log_member(env, struct_type, member,
2440					"Invalid member");
2441		return -EINVAL;
2442	}
2443
2444	resolved_member = *member;
2445	resolved_member.type = resolved_type_id;
2446
2447	return btf_type_ops(resolved_type)->check_kflag_member(env, struct_type,
2448							       &resolved_member,
2449							       resolved_type);
2450}
2451
2452static int btf_ptr_check_member(struct btf_verifier_env *env,
2453				const struct btf_type *struct_type,
2454				const struct btf_member *member,
2455				const struct btf_type *member_type)
2456{
2457	u32 struct_size, struct_bits_off, bytes_offset;
2458
2459	struct_size = struct_type->size;
2460	struct_bits_off = member->offset;
2461	bytes_offset = BITS_ROUNDDOWN_BYTES(struct_bits_off);
2462
2463	if (BITS_PER_BYTE_MASKED(struct_bits_off)) {
2464		btf_verifier_log_member(env, struct_type, member,
2465					"Member is not byte aligned");
2466		return -EINVAL;
2467	}
2468
2469	if (struct_size - bytes_offset < sizeof(void *)) {
2470		btf_verifier_log_member(env, struct_type, member,
2471					"Member exceeds struct_size");
2472		return -EINVAL;
2473	}
2474
2475	return 0;
2476}
2477
2478static int btf_ref_type_check_meta(struct btf_verifier_env *env,
2479				   const struct btf_type *t,
2480				   u32 meta_left)
2481{
2482	const char *value;
2483
2484	if (btf_type_vlen(t)) {
2485		btf_verifier_log_type(env, t, "vlen != 0");
2486		return -EINVAL;
2487	}
2488
2489	if (btf_type_kflag(t)) {
2490		btf_verifier_log_type(env, t, "Invalid btf_info kind_flag");
2491		return -EINVAL;
2492	}
2493
2494	if (!BTF_TYPE_ID_VALID(t->type)) {
2495		btf_verifier_log_type(env, t, "Invalid type_id");
2496		return -EINVAL;
2497	}
2498
2499	/* typedef/type_tag type must have a valid name, and other ref types,
2500	 * volatile, const, restrict, should have a null name.
2501	 */
2502	if (BTF_INFO_KIND(t->info) == BTF_KIND_TYPEDEF) {
2503		if (!t->name_off ||
2504		    !btf_name_valid_identifier(env->btf, t->name_off)) {
2505			btf_verifier_log_type(env, t, "Invalid name");
2506			return -EINVAL;
2507		}
2508	} else if (BTF_INFO_KIND(t->info) == BTF_KIND_TYPE_TAG) {
2509		value = btf_name_by_offset(env->btf, t->name_off);
2510		if (!value || !value[0]) {
2511			btf_verifier_log_type(env, t, "Invalid name");
2512			return -EINVAL;
2513		}
2514	} else {
2515		if (t->name_off) {
2516			btf_verifier_log_type(env, t, "Invalid name");
2517			return -EINVAL;
2518		}
2519	}
2520
2521	btf_verifier_log_type(env, t, NULL);
2522
2523	return 0;
2524}
2525
2526static int btf_modifier_resolve(struct btf_verifier_env *env,
2527				const struct resolve_vertex *v)
2528{
2529	const struct btf_type *t = v->t;
2530	const struct btf_type *next_type;
2531	u32 next_type_id = t->type;
2532	struct btf *btf = env->btf;
2533
2534	next_type = btf_type_by_id(btf, next_type_id);
2535	if (!next_type || btf_type_is_resolve_source_only(next_type)) {
2536		btf_verifier_log_type(env, v->t, "Invalid type_id");
2537		return -EINVAL;
2538	}
2539
2540	if (!env_type_is_resolve_sink(env, next_type) &&
2541	    !env_type_is_resolved(env, next_type_id))
2542		return env_stack_push(env, next_type, next_type_id);
2543
2544	/* Figure out the resolved next_type_id with size.
2545	 * They will be stored in the current modifier's
2546	 * resolved_ids and resolved_sizes such that it can
2547	 * save us a few type-following when we use it later (e.g. in
2548	 * pretty print).
2549	 */
2550	if (!btf_type_id_size(btf, &next_type_id, NULL)) {
2551		if (env_type_is_resolved(env, next_type_id))
2552			next_type = btf_type_id_resolve(btf, &next_type_id);
2553
2554		/* "typedef void new_void", "const void"...etc */
2555		if (!btf_type_is_void(next_type) &&
2556		    !btf_type_is_fwd(next_type) &&
2557		    !btf_type_is_func_proto(next_type)) {
2558			btf_verifier_log_type(env, v->t, "Invalid type_id");
2559			return -EINVAL;
2560		}
2561	}
2562
2563	env_stack_pop_resolved(env, next_type_id, 0);
2564
2565	return 0;
2566}
2567
2568static int btf_var_resolve(struct btf_verifier_env *env,
2569			   const struct resolve_vertex *v)
2570{
2571	const struct btf_type *next_type;
2572	const struct btf_type *t = v->t;
2573	u32 next_type_id = t->type;
2574	struct btf *btf = env->btf;
2575
2576	next_type = btf_type_by_id(btf, next_type_id);
2577	if (!next_type || btf_type_is_resolve_source_only(next_type)) {
2578		btf_verifier_log_type(env, v->t, "Invalid type_id");
2579		return -EINVAL;
2580	}
2581
2582	if (!env_type_is_resolve_sink(env, next_type) &&
2583	    !env_type_is_resolved(env, next_type_id))
2584		return env_stack_push(env, next_type, next_type_id);
2585
2586	if (btf_type_is_modifier(next_type)) {
2587		const struct btf_type *resolved_type;
2588		u32 resolved_type_id;
2589
2590		resolved_type_id = next_type_id;
2591		resolved_type = btf_type_id_resolve(btf, &resolved_type_id);
2592
2593		if (btf_type_is_ptr(resolved_type) &&
2594		    !env_type_is_resolve_sink(env, resolved_type) &&
2595		    !env_type_is_resolved(env, resolved_type_id))
2596			return env_stack_push(env, resolved_type,
2597					      resolved_type_id);
2598	}
2599
2600	/* We must resolve to something concrete at this point, no
2601	 * forward types or similar that would resolve to size of
2602	 * zero is allowed.
2603	 */
2604	if (!btf_type_id_size(btf, &next_type_id, NULL)) {
2605		btf_verifier_log_type(env, v->t, "Invalid type_id");
2606		return -EINVAL;
2607	}
2608
2609	env_stack_pop_resolved(env, next_type_id, 0);
2610
2611	return 0;
2612}
2613
2614static int btf_ptr_resolve(struct btf_verifier_env *env,
2615			   const struct resolve_vertex *v)
2616{
2617	const struct btf_type *next_type;
2618	const struct btf_type *t = v->t;
2619	u32 next_type_id = t->type;
2620	struct btf *btf = env->btf;
2621
2622	next_type = btf_type_by_id(btf, next_type_id);
2623	if (!next_type || btf_type_is_resolve_source_only(next_type)) {
2624		btf_verifier_log_type(env, v->t, "Invalid type_id");
2625		return -EINVAL;
2626	}
2627
2628	if (!env_type_is_resolve_sink(env, next_type) &&
2629	    !env_type_is_resolved(env, next_type_id))
2630		return env_stack_push(env, next_type, next_type_id);
2631
2632	/* If the modifier was RESOLVED during RESOLVE_STRUCT_OR_ARRAY,
2633	 * the modifier may have stopped resolving when it was resolved
2634	 * to a ptr (last-resolved-ptr).
2635	 *
2636	 * We now need to continue from the last-resolved-ptr to
2637	 * ensure the last-resolved-ptr will not referring back to
2638	 * the current ptr (t).
2639	 */
2640	if (btf_type_is_modifier(next_type)) {
2641		const struct btf_type *resolved_type;
2642		u32 resolved_type_id;
2643
2644		resolved_type_id = next_type_id;
2645		resolved_type = btf_type_id_resolve(btf, &resolved_type_id);
2646
2647		if (btf_type_is_ptr(resolved_type) &&
2648		    !env_type_is_resolve_sink(env, resolved_type) &&
2649		    !env_type_is_resolved(env, resolved_type_id))
2650			return env_stack_push(env, resolved_type,
2651					      resolved_type_id);
2652	}
2653
2654	if (!btf_type_id_size(btf, &next_type_id, NULL)) {
2655		if (env_type_is_resolved(env, next_type_id))
2656			next_type = btf_type_id_resolve(btf, &next_type_id);
2657
2658		if (!btf_type_is_void(next_type) &&
2659		    !btf_type_is_fwd(next_type) &&
2660		    !btf_type_is_func_proto(next_type)) {
2661			btf_verifier_log_type(env, v->t, "Invalid type_id");
2662			return -EINVAL;
2663		}
2664	}
2665
2666	env_stack_pop_resolved(env, next_type_id, 0);
2667
2668	return 0;
2669}
2670
2671static void btf_modifier_show(const struct btf *btf,
2672			      const struct btf_type *t,
2673			      u32 type_id, void *data,
2674			      u8 bits_offset, struct btf_show *show)
2675{
2676	if (btf->resolved_ids)
2677		t = btf_type_id_resolve(btf, &type_id);
2678	else
2679		t = btf_type_skip_modifiers(btf, type_id, NULL);
2680
2681	btf_type_ops(t)->show(btf, t, type_id, data, bits_offset, show);
2682}
2683
2684static void btf_var_show(const struct btf *btf, const struct btf_type *t,
2685			 u32 type_id, void *data, u8 bits_offset,
2686			 struct btf_show *show)
2687{
2688	t = btf_type_id_resolve(btf, &type_id);
2689
2690	btf_type_ops(t)->show(btf, t, type_id, data, bits_offset, show);
2691}
2692
2693static void btf_ptr_show(const struct btf *btf, const struct btf_type *t,
2694			 u32 type_id, void *data, u8 bits_offset,
2695			 struct btf_show *show)
2696{
2697	void *safe_data;
2698
2699	safe_data = btf_show_start_type(show, t, type_id, data);
2700	if (!safe_data)
2701		return;
2702
2703	/* It is a hashed value unless BTF_SHOW_PTR_RAW is specified */
2704	if (show->flags & BTF_SHOW_PTR_RAW)
2705		btf_show_type_value(show, "0x%px", *(void **)safe_data);
2706	else
2707		btf_show_type_value(show, "0x%p", *(void **)safe_data);
2708	btf_show_end_type(show);
2709}
2710
2711static void btf_ref_type_log(struct btf_verifier_env *env,
2712			     const struct btf_type *t)
2713{
2714	btf_verifier_log(env, "type_id=%u", t->type);
2715}
2716
2717static struct btf_kind_operations modifier_ops = {
2718	.check_meta = btf_ref_type_check_meta,
2719	.resolve = btf_modifier_resolve,
2720	.check_member = btf_modifier_check_member,
2721	.check_kflag_member = btf_modifier_check_kflag_member,
2722	.log_details = btf_ref_type_log,
2723	.show = btf_modifier_show,
2724};
2725
2726static struct btf_kind_operations ptr_ops = {
2727	.check_meta = btf_ref_type_check_meta,
2728	.resolve = btf_ptr_resolve,
2729	.check_member = btf_ptr_check_member,
2730	.check_kflag_member = btf_generic_check_kflag_member,
2731	.log_details = btf_ref_type_log,
2732	.show = btf_ptr_show,
2733};
2734
2735static s32 btf_fwd_check_meta(struct btf_verifier_env *env,
2736			      const struct btf_type *t,
2737			      u32 meta_left)
2738{
2739	if (btf_type_vlen(t)) {
2740		btf_verifier_log_type(env, t, "vlen != 0");
2741		return -EINVAL;
2742	}
2743
2744	if (t->type) {
2745		btf_verifier_log_type(env, t, "type != 0");
2746		return -EINVAL;
2747	}
2748
2749	/* fwd type must have a valid name */
2750	if (!t->name_off ||
2751	    !btf_name_valid_identifier(env->btf, t->name_off)) {
2752		btf_verifier_log_type(env, t, "Invalid name");
2753		return -EINVAL;
2754	}
2755
2756	btf_verifier_log_type(env, t, NULL);
2757
2758	return 0;
2759}
2760
2761static void btf_fwd_type_log(struct btf_verifier_env *env,
2762			     const struct btf_type *t)
2763{
2764	btf_verifier_log(env, "%s", btf_type_kflag(t) ? "union" : "struct");
2765}
2766
2767static struct btf_kind_operations fwd_ops = {
2768	.check_meta = btf_fwd_check_meta,
2769	.resolve = btf_df_resolve,
2770	.check_member = btf_df_check_member,
2771	.check_kflag_member = btf_df_check_kflag_member,
2772	.log_details = btf_fwd_type_log,
2773	.show = btf_df_show,
2774};
2775
2776static int btf_array_check_member(struct btf_verifier_env *env,
2777				  const struct btf_type *struct_type,
2778				  const struct btf_member *member,
2779				  const struct btf_type *member_type)
2780{
2781	u32 struct_bits_off = member->offset;
2782	u32 struct_size, bytes_offset;
2783	u32 array_type_id, array_size;
2784	struct btf *btf = env->btf;
2785
2786	if (BITS_PER_BYTE_MASKED(struct_bits_off)) {
2787		btf_verifier_log_member(env, struct_type, member,
2788					"Member is not byte aligned");
2789		return -EINVAL;
2790	}
2791
2792	array_type_id = member->type;
2793	btf_type_id_size(btf, &array_type_id, &array_size);
2794	struct_size = struct_type->size;
2795	bytes_offset = BITS_ROUNDDOWN_BYTES(struct_bits_off);
2796	if (struct_size - bytes_offset < array_size) {
2797		btf_verifier_log_member(env, struct_type, member,
2798					"Member exceeds struct_size");
2799		return -EINVAL;
2800	}
2801
2802	return 0;
2803}
2804
2805static s32 btf_array_check_meta(struct btf_verifier_env *env,
2806				const struct btf_type *t,
2807				u32 meta_left)
2808{
2809	const struct btf_array *array = btf_type_array(t);
2810	u32 meta_needed = sizeof(*array);
2811
2812	if (meta_left < meta_needed) {
2813		btf_verifier_log_basic(env, t,
2814				       "meta_left:%u meta_needed:%u",
2815				       meta_left, meta_needed);
2816		return -EINVAL;
2817	}
2818
2819	/* array type should not have a name */
2820	if (t->name_off) {
2821		btf_verifier_log_type(env, t, "Invalid name");
2822		return -EINVAL;
2823	}
2824
2825	if (btf_type_vlen(t)) {
2826		btf_verifier_log_type(env, t, "vlen != 0");
2827		return -EINVAL;
2828	}
2829
2830	if (btf_type_kflag(t)) {
2831		btf_verifier_log_type(env, t, "Invalid btf_info kind_flag");
2832		return -EINVAL;
2833	}
2834
2835	if (t->size) {
2836		btf_verifier_log_type(env, t, "size != 0");
2837		return -EINVAL;
2838	}
2839
2840	/* Array elem type and index type cannot be in type void,
2841	 * so !array->type and !array->index_type are not allowed.
2842	 */
2843	if (!array->type || !BTF_TYPE_ID_VALID(array->type)) {
2844		btf_verifier_log_type(env, t, "Invalid elem");
2845		return -EINVAL;
2846	}
2847
2848	if (!array->index_type || !BTF_TYPE_ID_VALID(array->index_type)) {
2849		btf_verifier_log_type(env, t, "Invalid index");
2850		return -EINVAL;
2851	}
2852
2853	btf_verifier_log_type(env, t, NULL);
2854
2855	return meta_needed;
2856}
2857
2858static int btf_array_resolve(struct btf_verifier_env *env,
2859			     const struct resolve_vertex *v)
2860{
2861	const struct btf_array *array = btf_type_array(v->t);
2862	const struct btf_type *elem_type, *index_type;
2863	u32 elem_type_id, index_type_id;
2864	struct btf *btf = env->btf;
2865	u32 elem_size;
2866
2867	/* Check array->index_type */
2868	index_type_id = array->index_type;
2869	index_type = btf_type_by_id(btf, index_type_id);
2870	if (btf_type_nosize_or_null(index_type) ||
2871	    btf_type_is_resolve_source_only(index_type)) {
2872		btf_verifier_log_type(env, v->t, "Invalid index");
2873		return -EINVAL;
2874	}
2875
2876	if (!env_type_is_resolve_sink(env, index_type) &&
2877	    !env_type_is_resolved(env, index_type_id))
2878		return env_stack_push(env, index_type, index_type_id);
2879
2880	index_type = btf_type_id_size(btf, &index_type_id, NULL);
2881	if (!index_type || !btf_type_is_int(index_type) ||
2882	    !btf_type_int_is_regular(index_type)) {
2883		btf_verifier_log_type(env, v->t, "Invalid index");
2884		return -EINVAL;
2885	}
2886
2887	/* Check array->type */
2888	elem_type_id = array->type;
2889	elem_type = btf_type_by_id(btf, elem_type_id);
2890	if (btf_type_nosize_or_null(elem_type) ||
2891	    btf_type_is_resolve_source_only(elem_type)) {
2892		btf_verifier_log_type(env, v->t,
2893				      "Invalid elem");
2894		return -EINVAL;
2895	}
2896
2897	if (!env_type_is_resolve_sink(env, elem_type) &&
2898	    !env_type_is_resolved(env, elem_type_id))
2899		return env_stack_push(env, elem_type, elem_type_id);
2900
2901	elem_type = btf_type_id_size(btf, &elem_type_id, &elem_size);
2902	if (!elem_type) {
2903		btf_verifier_log_type(env, v->t, "Invalid elem");
2904		return -EINVAL;
2905	}
2906
2907	if (btf_type_is_int(elem_type) && !btf_type_int_is_regular(elem_type)) {
2908		btf_verifier_log_type(env, v->t, "Invalid array of int");
2909		return -EINVAL;
2910	}
2911
2912	if (array->nelems && elem_size > U32_MAX / array->nelems) {
2913		btf_verifier_log_type(env, v->t,
2914				      "Array size overflows U32_MAX");
2915		return -EINVAL;
2916	}
2917
2918	env_stack_pop_resolved(env, elem_type_id, elem_size * array->nelems);
2919
2920	return 0;
2921}
2922
2923static void btf_array_log(struct btf_verifier_env *env,
2924			  const struct btf_type *t)
2925{
2926	const struct btf_array *array = btf_type_array(t);
2927
2928	btf_verifier_log(env, "type_id=%u index_type_id=%u nr_elems=%u",
2929			 array->type, array->index_type, array->nelems);
2930}
2931
2932static void __btf_array_show(const struct btf *btf, const struct btf_type *t,
2933			     u32 type_id, void *data, u8 bits_offset,
2934			     struct btf_show *show)
2935{
2936	const struct btf_array *array = btf_type_array(t);
2937	const struct btf_kind_operations *elem_ops;
2938	const struct btf_type *elem_type;
2939	u32 i, elem_size = 0, elem_type_id;
2940	u16 encoding = 0;
2941
2942	elem_type_id = array->type;
2943	elem_type = btf_type_skip_modifiers(btf, elem_type_id, NULL);
2944	if (elem_type && btf_type_has_size(elem_type))
2945		elem_size = elem_type->size;
2946
2947	if (elem_type && btf_type_is_int(elem_type)) {
2948		u32 int_type = btf_type_int(elem_type);
2949
2950		encoding = BTF_INT_ENCODING(int_type);
2951
2952		/*
2953		 * BTF_INT_CHAR encoding never seems to be set for
2954		 * char arrays, so if size is 1 and element is
2955		 * printable as a char, we'll do that.
2956		 */
2957		if (elem_size == 1)
2958			encoding = BTF_INT_CHAR;
2959	}
2960
2961	if (!btf_show_start_array_type(show, t, type_id, encoding, data))
2962		return;
2963
2964	if (!elem_type)
2965		goto out;
2966	elem_ops = btf_type_ops(elem_type);
2967
2968	for (i = 0; i < array->nelems; i++) {
2969
2970		btf_show_start_array_member(show);
2971
2972		elem_ops->show(btf, elem_type, elem_type_id, data,
2973			       bits_offset, show);
2974		data += elem_size;
2975
2976		btf_show_end_array_member(show);
2977
2978		if (show->state.array_terminated)
2979			break;
2980	}
2981out:
2982	btf_show_end_array_type(show);
2983}
2984
2985static void btf_array_show(const struct btf *btf, const struct btf_type *t,
2986			   u32 type_id, void *data, u8 bits_offset,
2987			   struct btf_show *show)
2988{
2989	const struct btf_member *m = show->state.member;
2990
2991	/*
2992	 * First check if any members would be shown (are non-zero).
2993	 * See comments above "struct btf_show" definition for more
2994	 * details on how this works at a high-level.
2995	 */
2996	if (show->state.depth > 0 && !(show->flags & BTF_SHOW_ZERO)) {
2997		if (!show->state.depth_check) {
2998			show->state.depth_check = show->state.depth + 1;
2999			show->state.depth_to_show = 0;
3000		}
3001		__btf_array_show(btf, t, type_id, data, bits_offset, show);
3002		show->state.member = m;
3003
3004		if (show->state.depth_check != show->state.depth + 1)
3005			return;
3006		show->state.depth_check = 0;
3007
3008		if (show->state.depth_to_show <= show->state.depth)
3009			return;
3010		/*
3011		 * Reaching here indicates we have recursed and found
3012		 * non-zero array member(s).
3013		 */
3014	}
3015	__btf_array_show(btf, t, type_id, data, bits_offset, show);
3016}
3017
3018static struct btf_kind_operations array_ops = {
3019	.check_meta = btf_array_check_meta,
3020	.resolve = btf_array_resolve,
3021	.check_member = btf_array_check_member,
3022	.check_kflag_member = btf_generic_check_kflag_member,
3023	.log_details = btf_array_log,
3024	.show = btf_array_show,
3025};
3026
3027static int btf_struct_check_member(struct btf_verifier_env *env,
3028				   const struct btf_type *struct_type,
3029				   const struct btf_member *member,
3030				   const struct btf_type *member_type)
3031{
3032	u32 struct_bits_off = member->offset;
3033	u32 struct_size, bytes_offset;
3034
3035	if (BITS_PER_BYTE_MASKED(struct_bits_off)) {
3036		btf_verifier_log_member(env, struct_type, member,
3037					"Member is not byte aligned");
3038		return -EINVAL;
3039	}
3040
3041	struct_size = struct_type->size;
3042	bytes_offset = BITS_ROUNDDOWN_BYTES(struct_bits_off);
3043	if (struct_size - bytes_offset < member_type->size) {
3044		btf_verifier_log_member(env, struct_type, member,
3045					"Member exceeds struct_size");
3046		return -EINVAL;
3047	}
3048
3049	return 0;
3050}
3051
3052static s32 btf_struct_check_meta(struct btf_verifier_env *env,
3053				 const struct btf_type *t,
3054				 u32 meta_left)
3055{
3056	bool is_union = BTF_INFO_KIND(t->info) == BTF_KIND_UNION;
3057	const struct btf_member *member;
3058	u32 meta_needed, last_offset;
3059	struct btf *btf = env->btf;
3060	u32 struct_size = t->size;
3061	u32 offset;
3062	u16 i;
3063
3064	meta_needed = btf_type_vlen(t) * sizeof(*member);
3065	if (meta_left < meta_needed) {
3066		btf_verifier_log_basic(env, t,
3067				       "meta_left:%u meta_needed:%u",
3068				       meta_left, meta_needed);
3069		return -EINVAL;
3070	}
3071
3072	/* struct type either no name or a valid one */
3073	if (t->name_off &&
3074	    !btf_name_valid_identifier(env->btf, t->name_off)) {
3075		btf_verifier_log_type(env, t, "Invalid name");
3076		return -EINVAL;
3077	}
3078
3079	btf_verifier_log_type(env, t, NULL);
3080
3081	last_offset = 0;
3082	for_each_member(i, t, member) {
3083		if (!btf_name_offset_valid(btf, member->name_off)) {
3084			btf_verifier_log_member(env, t, member,
3085						"Invalid member name_offset:%u",
3086						member->name_off);
3087			return -EINVAL;
3088		}
3089
3090		/* struct member either no name or a valid one */
3091		if (member->name_off &&
3092		    !btf_name_valid_identifier(btf, member->name_off)) {
3093			btf_verifier_log_member(env, t, member, "Invalid name");
3094			return -EINVAL;
3095		}
3096		/* A member cannot be in type void */
3097		if (!member->type || !BTF_TYPE_ID_VALID(member->type)) {
3098			btf_verifier_log_member(env, t, member,
3099						"Invalid type_id");
3100			return -EINVAL;
3101		}
3102
3103		offset = __btf_member_bit_offset(t, member);
3104		if (is_union && offset) {
3105			btf_verifier_log_member(env, t, member,
3106						"Invalid member bits_offset");
3107			return -EINVAL;
3108		}
3109
3110		/*
3111		 * ">" instead of ">=" because the last member could be
3112		 * "char a[0];"
3113		 */
3114		if (last_offset > offset) {
3115			btf_verifier_log_member(env, t, member,
3116						"Invalid member bits_offset");
3117			return -EINVAL;
3118		}
3119
3120		if (BITS_ROUNDUP_BYTES(offset) > struct_size) {
3121			btf_verifier_log_member(env, t, member,
3122						"Member bits_offset exceeds its struct size");
3123			return -EINVAL;
3124		}
3125
3126		btf_verifier_log_member(env, t, member, NULL);
3127		last_offset = offset;
3128	}
3129
3130	return meta_needed;
3131}
3132
3133static int btf_struct_resolve(struct btf_verifier_env *env,
3134			      const struct resolve_vertex *v)
3135{
3136	const struct btf_member *member;
3137	int err;
3138	u16 i;
3139
3140	/* Before continue resolving the next_member,
3141	 * ensure the last member is indeed resolved to a
3142	 * type with size info.
3143	 */
3144	if (v->next_member) {
3145		const struct btf_type *last_member_type;
3146		const struct btf_member *last_member;
3147		u32 last_member_type_id;
3148
3149		last_member = btf_type_member(v->t) + v->next_member - 1;
3150		last_member_type_id = last_member->type;
3151		if (WARN_ON_ONCE(!env_type_is_resolved(env,
3152						       last_member_type_id)))
3153			return -EINVAL;
3154
3155		last_member_type = btf_type_by_id(env->btf,
3156						  last_member_type_id);
3157		if (btf_type_kflag(v->t))
3158			err = btf_type_ops(last_member_type)->check_kflag_member(env, v->t,
3159								last_member,
3160								last_member_type);
3161		else
3162			err = btf_type_ops(last_member_type)->check_member(env, v->t,
3163								last_member,
3164								last_member_type);
3165		if (err)
3166			return err;
3167	}
3168
3169	for_each_member_from(i, v->next_member, v->t, member) {
3170		u32 member_type_id = member->type;
3171		const struct btf_type *member_type = btf_type_by_id(env->btf,
3172								member_type_id);
3173
3174		if (btf_type_nosize_or_null(member_type) ||
3175		    btf_type_is_resolve_source_only(member_type)) {
3176			btf_verifier_log_member(env, v->t, member,
3177						"Invalid member");
3178			return -EINVAL;
3179		}
3180
3181		if (!env_type_is_resolve_sink(env, member_type) &&
3182		    !env_type_is_resolved(env, member_type_id)) {
3183			env_stack_set_next_member(env, i + 1);
3184			return env_stack_push(env, member_type, member_type_id);
3185		}
3186
3187		if (btf_type_kflag(v->t))
3188			err = btf_type_ops(member_type)->check_kflag_member(env, v->t,
3189									    member,
3190									    member_type);
3191		else
3192			err = btf_type_ops(member_type)->check_member(env, v->t,
3193								      member,
3194								      member_type);
3195		if (err)
3196			return err;
3197	}
3198
3199	env_stack_pop_resolved(env, 0, 0);
3200
3201	return 0;
3202}
3203
3204static void btf_struct_log(struct btf_verifier_env *env,
3205			   const struct btf_type *t)
3206{
3207	btf_verifier_log(env, "size=%u vlen=%u", t->size, btf_type_vlen(t));
3208}
3209
3210enum btf_field_info_type {
3211	BTF_FIELD_SPIN_LOCK,
3212	BTF_FIELD_TIMER,
3213	BTF_FIELD_KPTR,
3214};
3215
3216enum {
3217	BTF_FIELD_IGNORE = 0,
3218	BTF_FIELD_FOUND  = 1,
3219};
3220
3221struct btf_field_info {
3222	enum btf_field_type type;
3223	u32 off;
3224	union {
3225		struct {
3226			u32 type_id;
3227		} kptr;
3228		struct {
3229			const char *node_name;
3230			u32 value_btf_id;
3231		} list_head;
3232	};
3233};
3234
3235static int btf_find_struct(const struct btf *btf, const struct btf_type *t,
3236			   u32 off, int sz, enum btf_field_type field_type,
3237			   struct btf_field_info *info)
3238{
3239	if (!__btf_type_is_struct(t))
3240		return BTF_FIELD_IGNORE;
3241	if (t->size != sz)
3242		return BTF_FIELD_IGNORE;
3243	info->type = field_type;
3244	info->off = off;
3245	return BTF_FIELD_FOUND;
3246}
3247
3248static int btf_find_kptr(const struct btf *btf, const struct btf_type *t,
3249			 u32 off, int sz, struct btf_field_info *info)
3250{
3251	enum btf_field_type type;
3252	u32 res_id;
3253
3254	/* Permit modifiers on the pointer itself */
3255	if (btf_type_is_volatile(t))
3256		t = btf_type_by_id(btf, t->type);
3257	/* For PTR, sz is always == 8 */
3258	if (!btf_type_is_ptr(t))
3259		return BTF_FIELD_IGNORE;
3260	t = btf_type_by_id(btf, t->type);
3261
3262	if (!btf_type_is_type_tag(t))
3263		return BTF_FIELD_IGNORE;
3264	/* Reject extra tags */
3265	if (btf_type_is_type_tag(btf_type_by_id(btf, t->type)))
3266		return -EINVAL;
3267	if (!strcmp("kptr", __btf_name_by_offset(btf, t->name_off)))
3268		type = BPF_KPTR_UNREF;
3269	else if (!strcmp("kptr_ref", __btf_name_by_offset(btf, t->name_off)))
3270		type = BPF_KPTR_REF;
 
 
 
 
3271	else
3272		return -EINVAL;
3273
 
 
 
3274	/* Get the base type */
3275	t = btf_type_skip_modifiers(btf, t->type, &res_id);
3276	/* Only pointer to struct is allowed */
3277	if (!__btf_type_is_struct(t))
3278		return -EINVAL;
3279
3280	info->type = type;
3281	info->off = off;
3282	info->kptr.type_id = res_id;
3283	return BTF_FIELD_FOUND;
3284}
3285
3286static const char *btf_find_decl_tag_value(const struct btf *btf,
3287					   const struct btf_type *pt,
3288					   int comp_idx, const char *tag_key)
3289{
3290	int i;
 
3291
3292	for (i = 1; i < btf_nr_types(btf); i++) {
3293		const struct btf_type *t = btf_type_by_id(btf, i);
3294		int len = strlen(tag_key);
3295
3296		if (!btf_type_is_decl_tag(t))
3297			continue;
3298		if (pt != btf_type_by_id(btf, t->type) ||
3299		    btf_type_decl_tag(t)->component_idx != comp_idx)
 
3300			continue;
3301		if (strncmp(__btf_name_by_offset(btf, t->name_off), tag_key, len))
3302			continue;
3303		return __btf_name_by_offset(btf, t->name_off) + len;
3304	}
3305	return NULL;
3306}
3307
3308static int btf_find_list_head(const struct btf *btf, const struct btf_type *pt,
3309			      const struct btf_type *t, int comp_idx,
3310			      u32 off, int sz, struct btf_field_info *info)
3311{
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
3312	const char *value_type;
3313	const char *list_node;
3314	s32 id;
3315
3316	if (!__btf_type_is_struct(t))
3317		return BTF_FIELD_IGNORE;
3318	if (t->size != sz)
3319		return BTF_FIELD_IGNORE;
3320	value_type = btf_find_decl_tag_value(btf, pt, comp_idx, "contains:");
3321	if (!value_type)
3322		return -EINVAL;
3323	list_node = strstr(value_type, ":");
3324	if (!list_node)
3325		return -EINVAL;
3326	value_type = kstrndup(value_type, list_node - value_type, GFP_KERNEL | __GFP_NOWARN);
3327	if (!value_type)
3328		return -ENOMEM;
3329	id = btf_find_by_name_kind(btf, value_type, BTF_KIND_STRUCT);
3330	kfree(value_type);
3331	if (id < 0)
3332		return id;
3333	list_node++;
3334	if (str_is_empty(list_node))
3335		return -EINVAL;
3336	info->type = BPF_LIST_HEAD;
3337	info->off = off;
3338	info->list_head.value_btf_id = id;
3339	info->list_head.node_name = list_node;
3340	return BTF_FIELD_FOUND;
3341}
3342
3343static int btf_get_field_type(const char *name, u32 field_mask, u32 *seen_mask,
 
 
 
 
 
 
 
3344			      int *align, int *sz)
3345{
3346	int type = 0;
 
3347
3348	if (field_mask & BPF_SPIN_LOCK) {
3349		if (!strcmp(name, "bpf_spin_lock")) {
3350			if (*seen_mask & BPF_SPIN_LOCK)
3351				return -E2BIG;
3352			*seen_mask |= BPF_SPIN_LOCK;
3353			type = BPF_SPIN_LOCK;
3354			goto end;
3355		}
3356	}
3357	if (field_mask & BPF_TIMER) {
3358		if (!strcmp(name, "bpf_timer")) {
3359			if (*seen_mask & BPF_TIMER)
3360				return -E2BIG;
3361			*seen_mask |= BPF_TIMER;
3362			type = BPF_TIMER;
3363			goto end;
3364		}
3365	}
3366	if (field_mask & BPF_LIST_HEAD) {
3367		if (!strcmp(name, "bpf_list_head")) {
3368			type = BPF_LIST_HEAD;
3369			goto end;
3370		}
3371	}
3372	if (field_mask & BPF_LIST_NODE) {
3373		if (!strcmp(name, "bpf_list_node")) {
3374			type = BPF_LIST_NODE;
3375			goto end;
3376		}
3377	}
 
 
 
 
 
 
3378	/* Only return BPF_KPTR when all other types with matchable names fail */
3379	if (field_mask & BPF_KPTR) {
3380		type = BPF_KPTR_REF;
3381		goto end;
3382	}
3383	return 0;
3384end:
3385	*sz = btf_field_type_size(type);
3386	*align = btf_field_type_align(type);
3387	return type;
3388}
3389
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
3390static int btf_find_struct_field(const struct btf *btf,
3391				 const struct btf_type *t, u32 field_mask,
3392				 struct btf_field_info *info, int info_cnt)
 
 
 
 
 
 
 
 
 
 
 
 
3393{
3394	int ret, idx = 0, align, sz, field_type;
3395	const struct btf_member *member;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
3396	struct btf_field_info tmp;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
3397	u32 i, off, seen_mask = 0;
3398
3399	for_each_member(i, t, member) {
3400		const struct btf_type *member_type = btf_type_by_id(btf,
3401								    member->type);
3402
3403		field_type = btf_get_field_type(__btf_name_by_offset(btf, member_type->name_off),
3404						field_mask, &seen_mask, &align, &sz);
3405		if (field_type == 0)
3406			continue;
3407		if (field_type < 0)
3408			return field_type;
3409
3410		off = __btf_member_bit_offset(t, member);
3411		if (off % 8)
3412			/* valid C code cannot generate such BTF */
3413			return -EINVAL;
3414		off /= 8;
3415		if (off % align)
3416			continue;
3417
3418		switch (field_type) {
3419		case BPF_SPIN_LOCK:
3420		case BPF_TIMER:
3421		case BPF_LIST_NODE:
3422			ret = btf_find_struct(btf, member_type, off, sz, field_type,
3423					      idx < info_cnt ? &info[idx] : &tmp);
3424			if (ret < 0)
3425				return ret;
3426			break;
3427		case BPF_KPTR_UNREF:
3428		case BPF_KPTR_REF:
3429			ret = btf_find_kptr(btf, member_type, off, sz,
3430					    idx < info_cnt ? &info[idx] : &tmp);
3431			if (ret < 0)
3432				return ret;
3433			break;
3434		case BPF_LIST_HEAD:
3435			ret = btf_find_list_head(btf, t, member_type, i, off, sz,
3436						 idx < info_cnt ? &info[idx] : &tmp);
3437			if (ret < 0)
3438				return ret;
3439			break;
3440		default:
3441			return -EFAULT;
3442		}
3443
3444		if (ret == BTF_FIELD_IGNORE)
3445			continue;
3446		if (idx >= info_cnt)
3447			return -E2BIG;
3448		++idx;
3449	}
3450	return idx;
3451}
3452
3453static int btf_find_datasec_var(const struct btf *btf, const struct btf_type *t,
3454				u32 field_mask, struct btf_field_info *info,
3455				int info_cnt)
3456{
3457	int ret, idx = 0, align, sz, field_type;
3458	const struct btf_var_secinfo *vsi;
3459	struct btf_field_info tmp;
3460	u32 i, off, seen_mask = 0;
3461
3462	for_each_vsi(i, t, vsi) {
3463		const struct btf_type *var = btf_type_by_id(btf, vsi->type);
3464		const struct btf_type *var_type = btf_type_by_id(btf, var->type);
3465
3466		field_type = btf_get_field_type(__btf_name_by_offset(btf, var_type->name_off),
3467						field_mask, &seen_mask, &align, &sz);
3468		if (field_type == 0)
3469			continue;
3470		if (field_type < 0)
3471			return field_type;
3472
3473		off = vsi->offset;
3474		if (vsi->size != sz)
3475			continue;
3476		if (off % align)
3477			continue;
3478
3479		switch (field_type) {
3480		case BPF_SPIN_LOCK:
3481		case BPF_TIMER:
3482		case BPF_LIST_NODE:
3483			ret = btf_find_struct(btf, var_type, off, sz, field_type,
3484					      idx < info_cnt ? &info[idx] : &tmp);
3485			if (ret < 0)
3486				return ret;
3487			break;
3488		case BPF_KPTR_UNREF:
3489		case BPF_KPTR_REF:
3490			ret = btf_find_kptr(btf, var_type, off, sz,
3491					    idx < info_cnt ? &info[idx] : &tmp);
3492			if (ret < 0)
3493				return ret;
3494			break;
3495		case BPF_LIST_HEAD:
3496			ret = btf_find_list_head(btf, var, var_type, -1, off, sz,
3497						 idx < info_cnt ? &info[idx] : &tmp);
3498			if (ret < 0)
3499				return ret;
3500			break;
3501		default:
3502			return -EFAULT;
3503		}
3504
3505		if (ret == BTF_FIELD_IGNORE)
3506			continue;
3507		if (idx >= info_cnt)
3508			return -E2BIG;
3509		++idx;
3510	}
3511	return idx;
3512}
3513
3514static int btf_find_field(const struct btf *btf, const struct btf_type *t,
3515			  u32 field_mask, struct btf_field_info *info,
3516			  int info_cnt)
3517{
3518	if (__btf_type_is_struct(t))
3519		return btf_find_struct_field(btf, t, field_mask, info, info_cnt);
3520	else if (btf_type_is_datasec(t))
3521		return btf_find_datasec_var(btf, t, field_mask, info, info_cnt);
3522	return -EINVAL;
3523}
3524
 
3525static int btf_parse_kptr(const struct btf *btf, struct btf_field *field,
3526			  struct btf_field_info *info)
3527{
3528	struct module *mod = NULL;
3529	const struct btf_type *t;
3530	struct btf *kernel_btf;
 
 
 
3531	int ret;
3532	s32 id;
3533
3534	/* Find type in map BTF, and use it to look up the matching type
3535	 * in vmlinux or module BTFs, by name and kind.
3536	 */
3537	t = btf_type_by_id(btf, info->kptr.type_id);
3538	id = bpf_find_btf_id(__btf_name_by_offset(btf, t->name_off), BTF_INFO_KIND(t->info),
3539			     &kernel_btf);
 
 
 
 
 
 
 
 
 
 
 
 
3540	if (id < 0)
3541		return id;
3542
3543	/* Find and stash the function pointer for the destruction function that
3544	 * needs to be eventually invoked from the map free path.
3545	 */
3546	if (info->type == BPF_KPTR_REF) {
3547		const struct btf_type *dtor_func;
3548		const char *dtor_func_name;
3549		unsigned long addr;
3550		s32 dtor_btf_id;
3551
3552		/* This call also serves as a whitelist of allowed objects that
3553		 * can be used as a referenced pointer and be stored in a map at
3554		 * the same time.
3555		 */
3556		dtor_btf_id = btf_find_dtor_kfunc(kernel_btf, id);
3557		if (dtor_btf_id < 0) {
3558			ret = dtor_btf_id;
3559			goto end_btf;
3560		}
3561
3562		dtor_func = btf_type_by_id(kernel_btf, dtor_btf_id);
3563		if (!dtor_func) {
3564			ret = -ENOENT;
3565			goto end_btf;
3566		}
3567
3568		if (btf_is_module(kernel_btf)) {
3569			mod = btf_try_get_module(kernel_btf);
3570			if (!mod) {
3571				ret = -ENXIO;
3572				goto end_btf;
3573			}
3574		}
3575
3576		/* We already verified dtor_func to be btf_type_is_func
3577		 * in register_btf_id_dtor_kfuncs.
3578		 */
3579		dtor_func_name = __btf_name_by_offset(kernel_btf, dtor_func->name_off);
3580		addr = kallsyms_lookup_name(dtor_func_name);
3581		if (!addr) {
3582			ret = -EINVAL;
3583			goto end_mod;
3584		}
3585		field->kptr.dtor = (void *)addr;
3586	}
3587
 
3588	field->kptr.btf_id = id;
3589	field->kptr.btf = kernel_btf;
3590	field->kptr.module = mod;
3591	return 0;
3592end_mod:
3593	module_put(mod);
3594end_btf:
3595	btf_put(kernel_btf);
3596	return ret;
3597}
3598
3599static int btf_parse_list_head(const struct btf *btf, struct btf_field *field,
3600			       struct btf_field_info *info)
 
 
 
3601{
3602	const struct btf_type *t, *n = NULL;
3603	const struct btf_member *member;
3604	u32 offset;
3605	int i;
3606
3607	t = btf_type_by_id(btf, info->list_head.value_btf_id);
3608	/* We've already checked that value_btf_id is a struct type. We
3609	 * just need to figure out the offset of the list_node, and
3610	 * verify its type.
3611	 */
3612	for_each_member(i, t, member) {
3613		if (strcmp(info->list_head.node_name, __btf_name_by_offset(btf, member->name_off)))
 
3614			continue;
3615		/* Invalid BTF, two members with same name */
3616		if (n)
3617			return -EINVAL;
3618		n = btf_type_by_id(btf, member->type);
3619		if (!__btf_type_is_struct(n))
3620			return -EINVAL;
3621		if (strcmp("bpf_list_node", __btf_name_by_offset(btf, n->name_off)))
3622			return -EINVAL;
3623		offset = __btf_member_bit_offset(n, member);
3624		if (offset % 8)
3625			return -EINVAL;
3626		offset /= 8;
3627		if (offset % __alignof__(struct bpf_list_node))
3628			return -EINVAL;
3629
3630		field->list_head.btf = (struct btf *)btf;
3631		field->list_head.value_btf_id = info->list_head.value_btf_id;
3632		field->list_head.node_offset = offset;
3633	}
3634	if (!n)
3635		return -ENOENT;
3636	return 0;
3637}
3638
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
3639struct btf_record *btf_parse_fields(const struct btf *btf, const struct btf_type *t,
3640				    u32 field_mask, u32 value_size)
3641{
3642	struct btf_field_info info_arr[BTF_FIELDS_MAX];
 
3643	struct btf_record *rec;
3644	u32 next_off = 0;
3645	int ret, i, cnt;
3646
3647	ret = btf_find_field(btf, t, field_mask, info_arr, ARRAY_SIZE(info_arr));
3648	if (ret < 0)
3649		return ERR_PTR(ret);
3650	if (!ret)
3651		return NULL;
3652
3653	cnt = ret;
3654	/* This needs to be kzalloc to zero out padding and unused fields, see
3655	 * comment in btf_record_equal.
3656	 */
3657	rec = kzalloc(offsetof(struct btf_record, fields[cnt]), GFP_KERNEL | __GFP_NOWARN);
3658	if (!rec)
3659		return ERR_PTR(-ENOMEM);
3660
3661	rec->spin_lock_off = -EINVAL;
3662	rec->timer_off = -EINVAL;
 
 
3663	for (i = 0; i < cnt; i++) {
3664		if (info_arr[i].off + btf_field_type_size(info_arr[i].type) > value_size) {
 
3665			WARN_ONCE(1, "verifier bug off %d size %d", info_arr[i].off, value_size);
3666			ret = -EFAULT;
3667			goto end;
3668		}
3669		if (info_arr[i].off < next_off) {
3670			ret = -EEXIST;
3671			goto end;
3672		}
3673		next_off = info_arr[i].off + btf_field_type_size(info_arr[i].type);
3674
3675		rec->field_mask |= info_arr[i].type;
3676		rec->fields[i].offset = info_arr[i].off;
3677		rec->fields[i].type = info_arr[i].type;
 
3678
3679		switch (info_arr[i].type) {
3680		case BPF_SPIN_LOCK:
3681			WARN_ON_ONCE(rec->spin_lock_off >= 0);
3682			/* Cache offset for faster lookup at runtime */
3683			rec->spin_lock_off = rec->fields[i].offset;
3684			break;
3685		case BPF_TIMER:
3686			WARN_ON_ONCE(rec->timer_off >= 0);
3687			/* Cache offset for faster lookup at runtime */
3688			rec->timer_off = rec->fields[i].offset;
3689			break;
 
 
 
 
 
 
 
 
 
 
3690		case BPF_KPTR_UNREF:
3691		case BPF_KPTR_REF:
 
 
3692			ret = btf_parse_kptr(btf, &rec->fields[i], &info_arr[i]);
3693			if (ret < 0)
3694				goto end;
3695			break;
3696		case BPF_LIST_HEAD:
3697			ret = btf_parse_list_head(btf, &rec->fields[i], &info_arr[i]);
3698			if (ret < 0)
3699				goto end;
3700			break;
 
 
 
 
 
3701		case BPF_LIST_NODE:
 
3702			break;
3703		default:
3704			ret = -EFAULT;
3705			goto end;
3706		}
3707		rec->cnt++;
3708	}
3709
3710	/* bpf_list_head requires bpf_spin_lock */
3711	if (btf_record_has_field(rec, BPF_LIST_HEAD) && rec->spin_lock_off < 0) {
 
 
 
 
 
 
 
 
3712		ret = -EINVAL;
3713		goto end;
3714	}
3715
 
 
 
3716	return rec;
3717end:
3718	btf_record_free(rec);
3719	return ERR_PTR(ret);
3720}
3721
3722int btf_check_and_fixup_fields(const struct btf *btf, struct btf_record *rec)
3723{
3724	int i;
3725
3726	/* There are two owning types, kptr_ref and bpf_list_head. The former
3727	 * only supports storing kernel types, which can never store references
3728	 * to program allocated local types, atleast not yet. Hence we only need
3729	 * to ensure that bpf_list_head ownership does not form cycles.
 
 
 
3730	 */
3731	if (IS_ERR_OR_NULL(rec) || !(rec->field_mask & BPF_LIST_HEAD))
3732		return 0;
3733	for (i = 0; i < rec->cnt; i++) {
3734		struct btf_struct_meta *meta;
 
3735		u32 btf_id;
3736
3737		if (!(rec->fields[i].type & BPF_LIST_HEAD))
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
3738			continue;
3739		btf_id = rec->fields[i].list_head.value_btf_id;
3740		meta = btf_find_struct_meta(btf, btf_id);
3741		if (!meta)
3742			return -EFAULT;
3743		rec->fields[i].list_head.value_rec = meta->record;
3744
3745		if (!(rec->field_mask & BPF_LIST_NODE))
 
 
 
 
3746			continue;
3747
3748		/* We need to ensure ownership acyclicity among all types. The
3749		 * proper way to do it would be to topologically sort all BTF
3750		 * IDs based on the ownership edges, since there can be multiple
3751		 * bpf_list_head in a type. Instead, we use the following
3752		 * reasoning:
3753		 *
3754		 * - A type can only be owned by another type in user BTF if it
3755		 *   has a bpf_list_node.
3756		 * - A type can only _own_ another type in user BTF if it has a
3757		 *   bpf_list_head.
3758		 *
3759		 * We ensure that if a type has both bpf_list_head and
3760		 * bpf_list_node, its element types cannot be owning types.
3761		 *
3762		 * To ensure acyclicity:
3763		 *
3764		 * When A only has bpf_list_head, ownership chain can be:
 
3765		 *	A -> B -> C
3766		 * Where:
3767		 * - B has both bpf_list_head and bpf_list_node.
3768		 * - C only has bpf_list_node.
 
 
3769		 *
3770		 * When A has both bpf_list_head and bpf_list_node, some other
3771		 * type already owns it in the BTF domain, hence it can not own
3772		 * another owning type through any of the bpf_list_head edges.
3773		 *	A -> B
3774		 * Where:
3775		 * - B only has bpf_list_node.
 
3776		 */
3777		if (meta->record->field_mask & BPF_LIST_HEAD)
3778			return -ELOOP;
3779	}
3780	return 0;
3781}
3782
3783static int btf_field_offs_cmp(const void *_a, const void *_b, const void *priv)
3784{
3785	const u32 a = *(const u32 *)_a;
3786	const u32 b = *(const u32 *)_b;
3787
3788	if (a < b)
3789		return -1;
3790	else if (a > b)
3791		return 1;
3792	return 0;
3793}
3794
3795static void btf_field_offs_swap(void *_a, void *_b, int size, const void *priv)
3796{
3797	struct btf_field_offs *foffs = (void *)priv;
3798	u32 *off_base = foffs->field_off;
3799	u32 *a = _a, *b = _b;
3800	u8 *sz_a, *sz_b;
3801
3802	sz_a = foffs->field_sz + (a - off_base);
3803	sz_b = foffs->field_sz + (b - off_base);
3804
3805	swap(*a, *b);
3806	swap(*sz_a, *sz_b);
3807}
3808
3809struct btf_field_offs *btf_parse_field_offs(struct btf_record *rec)
3810{
3811	struct btf_field_offs *foffs;
3812	u32 i, *off;
3813	u8 *sz;
3814
3815	BUILD_BUG_ON(ARRAY_SIZE(foffs->field_off) != ARRAY_SIZE(foffs->field_sz));
3816	if (IS_ERR_OR_NULL(rec))
3817		return NULL;
3818
3819	foffs = kzalloc(sizeof(*foffs), GFP_KERNEL | __GFP_NOWARN);
3820	if (!foffs)
3821		return ERR_PTR(-ENOMEM);
3822
3823	off = foffs->field_off;
3824	sz = foffs->field_sz;
3825	for (i = 0; i < rec->cnt; i++) {
3826		off[i] = rec->fields[i].offset;
3827		sz[i] = btf_field_type_size(rec->fields[i].type);
3828	}
3829	foffs->cnt = rec->cnt;
3830
3831	if (foffs->cnt == 1)
3832		return foffs;
3833	sort_r(foffs->field_off, foffs->cnt, sizeof(foffs->field_off[0]),
3834	       btf_field_offs_cmp, btf_field_offs_swap, foffs);
3835	return foffs;
3836}
3837
3838static void __btf_struct_show(const struct btf *btf, const struct btf_type *t,
3839			      u32 type_id, void *data, u8 bits_offset,
3840			      struct btf_show *show)
3841{
3842	const struct btf_member *member;
3843	void *safe_data;
3844	u32 i;
3845
3846	safe_data = btf_show_start_struct_type(show, t, type_id, data);
3847	if (!safe_data)
3848		return;
3849
3850	for_each_member(i, t, member) {
3851		const struct btf_type *member_type = btf_type_by_id(btf,
3852								member->type);
3853		const struct btf_kind_operations *ops;
3854		u32 member_offset, bitfield_size;
3855		u32 bytes_offset;
3856		u8 bits8_offset;
3857
3858		btf_show_start_member(show, member);
3859
3860		member_offset = __btf_member_bit_offset(t, member);
3861		bitfield_size = __btf_member_bitfield_size(t, member);
3862		bytes_offset = BITS_ROUNDDOWN_BYTES(member_offset);
3863		bits8_offset = BITS_PER_BYTE_MASKED(member_offset);
3864		if (bitfield_size) {
3865			safe_data = btf_show_start_type(show, member_type,
3866							member->type,
3867							data + bytes_offset);
3868			if (safe_data)
3869				btf_bitfield_show(safe_data,
3870						  bits8_offset,
3871						  bitfield_size, show);
3872			btf_show_end_type(show);
3873		} else {
3874			ops = btf_type_ops(member_type);
3875			ops->show(btf, member_type, member->type,
3876				  data + bytes_offset, bits8_offset, show);
3877		}
3878
3879		btf_show_end_member(show);
3880	}
3881
3882	btf_show_end_struct_type(show);
3883}
3884
3885static void btf_struct_show(const struct btf *btf, const struct btf_type *t,
3886			    u32 type_id, void *data, u8 bits_offset,
3887			    struct btf_show *show)
3888{
3889	const struct btf_member *m = show->state.member;
3890
3891	/*
3892	 * First check if any members would be shown (are non-zero).
3893	 * See comments above "struct btf_show" definition for more
3894	 * details on how this works at a high-level.
3895	 */
3896	if (show->state.depth > 0 && !(show->flags & BTF_SHOW_ZERO)) {
3897		if (!show->state.depth_check) {
3898			show->state.depth_check = show->state.depth + 1;
3899			show->state.depth_to_show = 0;
3900		}
3901		__btf_struct_show(btf, t, type_id, data, bits_offset, show);
3902		/* Restore saved member data here */
3903		show->state.member = m;
3904		if (show->state.depth_check != show->state.depth + 1)
3905			return;
3906		show->state.depth_check = 0;
3907
3908		if (show->state.depth_to_show <= show->state.depth)
3909			return;
3910		/*
3911		 * Reaching here indicates we have recursed and found
3912		 * non-zero child values.
3913		 */
3914	}
3915
3916	__btf_struct_show(btf, t, type_id, data, bits_offset, show);
3917}
3918
3919static struct btf_kind_operations struct_ops = {
3920	.check_meta = btf_struct_check_meta,
3921	.resolve = btf_struct_resolve,
3922	.check_member = btf_struct_check_member,
3923	.check_kflag_member = btf_generic_check_kflag_member,
3924	.log_details = btf_struct_log,
3925	.show = btf_struct_show,
3926};
3927
3928static int btf_enum_check_member(struct btf_verifier_env *env,
3929				 const struct btf_type *struct_type,
3930				 const struct btf_member *member,
3931				 const struct btf_type *member_type)
3932{
3933	u32 struct_bits_off = member->offset;
3934	u32 struct_size, bytes_offset;
3935
3936	if (BITS_PER_BYTE_MASKED(struct_bits_off)) {
3937		btf_verifier_log_member(env, struct_type, member,
3938					"Member is not byte aligned");
3939		return -EINVAL;
3940	}
3941
3942	struct_size = struct_type->size;
3943	bytes_offset = BITS_ROUNDDOWN_BYTES(struct_bits_off);
3944	if (struct_size - bytes_offset < member_type->size) {
3945		btf_verifier_log_member(env, struct_type, member,
3946					"Member exceeds struct_size");
3947		return -EINVAL;
3948	}
3949
3950	return 0;
3951}
3952
3953static int btf_enum_check_kflag_member(struct btf_verifier_env *env,
3954				       const struct btf_type *struct_type,
3955				       const struct btf_member *member,
3956				       const struct btf_type *member_type)
3957{
3958	u32 struct_bits_off, nr_bits, bytes_end, struct_size;
3959	u32 int_bitsize = sizeof(int) * BITS_PER_BYTE;
3960
3961	struct_bits_off = BTF_MEMBER_BIT_OFFSET(member->offset);
3962	nr_bits = BTF_MEMBER_BITFIELD_SIZE(member->offset);
3963	if (!nr_bits) {
3964		if (BITS_PER_BYTE_MASKED(struct_bits_off)) {
3965			btf_verifier_log_member(env, struct_type, member,
3966						"Member is not byte aligned");
3967			return -EINVAL;
3968		}
3969
3970		nr_bits = int_bitsize;
3971	} else if (nr_bits > int_bitsize) {
3972		btf_verifier_log_member(env, struct_type, member,
3973					"Invalid member bitfield_size");
3974		return -EINVAL;
3975	}
3976
3977	struct_size = struct_type->size;
3978	bytes_end = BITS_ROUNDUP_BYTES(struct_bits_off + nr_bits);
3979	if (struct_size < bytes_end) {
3980		btf_verifier_log_member(env, struct_type, member,
3981					"Member exceeds struct_size");
3982		return -EINVAL;
3983	}
3984
3985	return 0;
3986}
3987
3988static s32 btf_enum_check_meta(struct btf_verifier_env *env,
3989			       const struct btf_type *t,
3990			       u32 meta_left)
3991{
3992	const struct btf_enum *enums = btf_type_enum(t);
3993	struct btf *btf = env->btf;
3994	const char *fmt_str;
3995	u16 i, nr_enums;
3996	u32 meta_needed;
3997
3998	nr_enums = btf_type_vlen(t);
3999	meta_needed = nr_enums * sizeof(*enums);
4000
4001	if (meta_left < meta_needed) {
4002		btf_verifier_log_basic(env, t,
4003				       "meta_left:%u meta_needed:%u",
4004				       meta_left, meta_needed);
4005		return -EINVAL;
4006	}
4007
4008	if (t->size > 8 || !is_power_of_2(t->size)) {
4009		btf_verifier_log_type(env, t, "Unexpected size");
4010		return -EINVAL;
4011	}
4012
4013	/* enum type either no name or a valid one */
4014	if (t->name_off &&
4015	    !btf_name_valid_identifier(env->btf, t->name_off)) {
4016		btf_verifier_log_type(env, t, "Invalid name");
4017		return -EINVAL;
4018	}
4019
4020	btf_verifier_log_type(env, t, NULL);
4021
4022	for (i = 0; i < nr_enums; i++) {
4023		if (!btf_name_offset_valid(btf, enums[i].name_off)) {
4024			btf_verifier_log(env, "\tInvalid name_offset:%u",
4025					 enums[i].name_off);
4026			return -EINVAL;
4027		}
4028
4029		/* enum member must have a valid name */
4030		if (!enums[i].name_off ||
4031		    !btf_name_valid_identifier(btf, enums[i].name_off)) {
4032			btf_verifier_log_type(env, t, "Invalid name");
4033			return -EINVAL;
4034		}
4035
4036		if (env->log.level == BPF_LOG_KERNEL)
4037			continue;
4038		fmt_str = btf_type_kflag(t) ? "\t%s val=%d\n" : "\t%s val=%u\n";
4039		btf_verifier_log(env, fmt_str,
4040				 __btf_name_by_offset(btf, enums[i].name_off),
4041				 enums[i].val);
4042	}
4043
4044	return meta_needed;
4045}
4046
4047static void btf_enum_log(struct btf_verifier_env *env,
4048			 const struct btf_type *t)
4049{
4050	btf_verifier_log(env, "size=%u vlen=%u", t->size, btf_type_vlen(t));
4051}
4052
4053static void btf_enum_show(const struct btf *btf, const struct btf_type *t,
4054			  u32 type_id, void *data, u8 bits_offset,
4055			  struct btf_show *show)
4056{
4057	const struct btf_enum *enums = btf_type_enum(t);
4058	u32 i, nr_enums = btf_type_vlen(t);
4059	void *safe_data;
4060	int v;
4061
4062	safe_data = btf_show_start_type(show, t, type_id, data);
4063	if (!safe_data)
4064		return;
4065
4066	v = *(int *)safe_data;
4067
4068	for (i = 0; i < nr_enums; i++) {
4069		if (v != enums[i].val)
4070			continue;
4071
4072		btf_show_type_value(show, "%s",
4073				    __btf_name_by_offset(btf,
4074							 enums[i].name_off));
4075
4076		btf_show_end_type(show);
4077		return;
4078	}
4079
4080	if (btf_type_kflag(t))
4081		btf_show_type_value(show, "%d", v);
4082	else
4083		btf_show_type_value(show, "%u", v);
4084	btf_show_end_type(show);
4085}
4086
4087static struct btf_kind_operations enum_ops = {
4088	.check_meta = btf_enum_check_meta,
4089	.resolve = btf_df_resolve,
4090	.check_member = btf_enum_check_member,
4091	.check_kflag_member = btf_enum_check_kflag_member,
4092	.log_details = btf_enum_log,
4093	.show = btf_enum_show,
4094};
4095
4096static s32 btf_enum64_check_meta(struct btf_verifier_env *env,
4097				 const struct btf_type *t,
4098				 u32 meta_left)
4099{
4100	const struct btf_enum64 *enums = btf_type_enum64(t);
4101	struct btf *btf = env->btf;
4102	const char *fmt_str;
4103	u16 i, nr_enums;
4104	u32 meta_needed;
4105
4106	nr_enums = btf_type_vlen(t);
4107	meta_needed = nr_enums * sizeof(*enums);
4108
4109	if (meta_left < meta_needed) {
4110		btf_verifier_log_basic(env, t,
4111				       "meta_left:%u meta_needed:%u",
4112				       meta_left, meta_needed);
4113		return -EINVAL;
4114	}
4115
4116	if (t->size > 8 || !is_power_of_2(t->size)) {
4117		btf_verifier_log_type(env, t, "Unexpected size");
4118		return -EINVAL;
4119	}
4120
4121	/* enum type either no name or a valid one */
4122	if (t->name_off &&
4123	    !btf_name_valid_identifier(env->btf, t->name_off)) {
4124		btf_verifier_log_type(env, t, "Invalid name");
4125		return -EINVAL;
4126	}
4127
4128	btf_verifier_log_type(env, t, NULL);
4129
4130	for (i = 0; i < nr_enums; i++) {
4131		if (!btf_name_offset_valid(btf, enums[i].name_off)) {
4132			btf_verifier_log(env, "\tInvalid name_offset:%u",
4133					 enums[i].name_off);
4134			return -EINVAL;
4135		}
4136
4137		/* enum member must have a valid name */
4138		if (!enums[i].name_off ||
4139		    !btf_name_valid_identifier(btf, enums[i].name_off)) {
4140			btf_verifier_log_type(env, t, "Invalid name");
4141			return -EINVAL;
4142		}
4143
4144		if (env->log.level == BPF_LOG_KERNEL)
4145			continue;
4146
4147		fmt_str = btf_type_kflag(t) ? "\t%s val=%lld\n" : "\t%s val=%llu\n";
4148		btf_verifier_log(env, fmt_str,
4149				 __btf_name_by_offset(btf, enums[i].name_off),
4150				 btf_enum64_value(enums + i));
4151	}
4152
4153	return meta_needed;
4154}
4155
4156static void btf_enum64_show(const struct btf *btf, const struct btf_type *t,
4157			    u32 type_id, void *data, u8 bits_offset,
4158			    struct btf_show *show)
4159{
4160	const struct btf_enum64 *enums = btf_type_enum64(t);
4161	u32 i, nr_enums = btf_type_vlen(t);
4162	void *safe_data;
4163	s64 v;
4164
4165	safe_data = btf_show_start_type(show, t, type_id, data);
4166	if (!safe_data)
4167		return;
4168
4169	v = *(u64 *)safe_data;
4170
4171	for (i = 0; i < nr_enums; i++) {
4172		if (v != btf_enum64_value(enums + i))
4173			continue;
4174
4175		btf_show_type_value(show, "%s",
4176				    __btf_name_by_offset(btf,
4177							 enums[i].name_off));
4178
4179		btf_show_end_type(show);
4180		return;
4181	}
4182
4183	if (btf_type_kflag(t))
4184		btf_show_type_value(show, "%lld", v);
4185	else
4186		btf_show_type_value(show, "%llu", v);
4187	btf_show_end_type(show);
4188}
4189
4190static struct btf_kind_operations enum64_ops = {
4191	.check_meta = btf_enum64_check_meta,
4192	.resolve = btf_df_resolve,
4193	.check_member = btf_enum_check_member,
4194	.check_kflag_member = btf_enum_check_kflag_member,
4195	.log_details = btf_enum_log,
4196	.show = btf_enum64_show,
4197};
4198
4199static s32 btf_func_proto_check_meta(struct btf_verifier_env *env,
4200				     const struct btf_type *t,
4201				     u32 meta_left)
4202{
4203	u32 meta_needed = btf_type_vlen(t) * sizeof(struct btf_param);
4204
4205	if (meta_left < meta_needed) {
4206		btf_verifier_log_basic(env, t,
4207				       "meta_left:%u meta_needed:%u",
4208				       meta_left, meta_needed);
4209		return -EINVAL;
4210	}
4211
4212	if (t->name_off) {
4213		btf_verifier_log_type(env, t, "Invalid name");
4214		return -EINVAL;
4215	}
4216
4217	if (btf_type_kflag(t)) {
4218		btf_verifier_log_type(env, t, "Invalid btf_info kind_flag");
4219		return -EINVAL;
4220	}
4221
4222	btf_verifier_log_type(env, t, NULL);
4223
4224	return meta_needed;
4225}
4226
4227static void btf_func_proto_log(struct btf_verifier_env *env,
4228			       const struct btf_type *t)
4229{
4230	const struct btf_param *args = (const struct btf_param *)(t + 1);
4231	u16 nr_args = btf_type_vlen(t), i;
4232
4233	btf_verifier_log(env, "return=%u args=(", t->type);
4234	if (!nr_args) {
4235		btf_verifier_log(env, "void");
4236		goto done;
4237	}
4238
4239	if (nr_args == 1 && !args[0].type) {
4240		/* Only one vararg */
4241		btf_verifier_log(env, "vararg");
4242		goto done;
4243	}
4244
4245	btf_verifier_log(env, "%u %s", args[0].type,
4246			 __btf_name_by_offset(env->btf,
4247					      args[0].name_off));
4248	for (i = 1; i < nr_args - 1; i++)
4249		btf_verifier_log(env, ", %u %s", args[i].type,
4250				 __btf_name_by_offset(env->btf,
4251						      args[i].name_off));
4252
4253	if (nr_args > 1) {
4254		const struct btf_param *last_arg = &args[nr_args - 1];
4255
4256		if (last_arg->type)
4257			btf_verifier_log(env, ", %u %s", last_arg->type,
4258					 __btf_name_by_offset(env->btf,
4259							      last_arg->name_off));
4260		else
4261			btf_verifier_log(env, ", vararg");
4262	}
4263
4264done:
4265	btf_verifier_log(env, ")");
4266}
4267
4268static struct btf_kind_operations func_proto_ops = {
4269	.check_meta = btf_func_proto_check_meta,
4270	.resolve = btf_df_resolve,
4271	/*
4272	 * BTF_KIND_FUNC_PROTO cannot be directly referred by
4273	 * a struct's member.
4274	 *
4275	 * It should be a function pointer instead.
4276	 * (i.e. struct's member -> BTF_KIND_PTR -> BTF_KIND_FUNC_PROTO)
4277	 *
4278	 * Hence, there is no btf_func_check_member().
4279	 */
4280	.check_member = btf_df_check_member,
4281	.check_kflag_member = btf_df_check_kflag_member,
4282	.log_details = btf_func_proto_log,
4283	.show = btf_df_show,
4284};
4285
4286static s32 btf_func_check_meta(struct btf_verifier_env *env,
4287			       const struct btf_type *t,
4288			       u32 meta_left)
4289{
4290	if (!t->name_off ||
4291	    !btf_name_valid_identifier(env->btf, t->name_off)) {
4292		btf_verifier_log_type(env, t, "Invalid name");
4293		return -EINVAL;
4294	}
4295
4296	if (btf_type_vlen(t) > BTF_FUNC_GLOBAL) {
4297		btf_verifier_log_type(env, t, "Invalid func linkage");
4298		return -EINVAL;
4299	}
4300
4301	if (btf_type_kflag(t)) {
4302		btf_verifier_log_type(env, t, "Invalid btf_info kind_flag");
4303		return -EINVAL;
4304	}
4305
4306	btf_verifier_log_type(env, t, NULL);
4307
4308	return 0;
4309}
4310
4311static int btf_func_resolve(struct btf_verifier_env *env,
4312			    const struct resolve_vertex *v)
4313{
4314	const struct btf_type *t = v->t;
4315	u32 next_type_id = t->type;
4316	int err;
4317
4318	err = btf_func_check(env, t);
4319	if (err)
4320		return err;
4321
4322	env_stack_pop_resolved(env, next_type_id, 0);
4323	return 0;
4324}
4325
4326static struct btf_kind_operations func_ops = {
4327	.check_meta = btf_func_check_meta,
4328	.resolve = btf_func_resolve,
4329	.check_member = btf_df_check_member,
4330	.check_kflag_member = btf_df_check_kflag_member,
4331	.log_details = btf_ref_type_log,
4332	.show = btf_df_show,
4333};
4334
4335static s32 btf_var_check_meta(struct btf_verifier_env *env,
4336			      const struct btf_type *t,
4337			      u32 meta_left)
4338{
4339	const struct btf_var *var;
4340	u32 meta_needed = sizeof(*var);
4341
4342	if (meta_left < meta_needed) {
4343		btf_verifier_log_basic(env, t,
4344				       "meta_left:%u meta_needed:%u",
4345				       meta_left, meta_needed);
4346		return -EINVAL;
4347	}
4348
4349	if (btf_type_vlen(t)) {
4350		btf_verifier_log_type(env, t, "vlen != 0");
4351		return -EINVAL;
4352	}
4353
4354	if (btf_type_kflag(t)) {
4355		btf_verifier_log_type(env, t, "Invalid btf_info kind_flag");
4356		return -EINVAL;
4357	}
4358
4359	if (!t->name_off ||
4360	    !__btf_name_valid(env->btf, t->name_off, true)) {
4361		btf_verifier_log_type(env, t, "Invalid name");
4362		return -EINVAL;
4363	}
4364
4365	/* A var cannot be in type void */
4366	if (!t->type || !BTF_TYPE_ID_VALID(t->type)) {
4367		btf_verifier_log_type(env, t, "Invalid type_id");
4368		return -EINVAL;
4369	}
4370
4371	var = btf_type_var(t);
4372	if (var->linkage != BTF_VAR_STATIC &&
4373	    var->linkage != BTF_VAR_GLOBAL_ALLOCATED) {
4374		btf_verifier_log_type(env, t, "Linkage not supported");
4375		return -EINVAL;
4376	}
4377
4378	btf_verifier_log_type(env, t, NULL);
4379
4380	return meta_needed;
4381}
4382
4383static void btf_var_log(struct btf_verifier_env *env, const struct btf_type *t)
4384{
4385	const struct btf_var *var = btf_type_var(t);
4386
4387	btf_verifier_log(env, "type_id=%u linkage=%u", t->type, var->linkage);
4388}
4389
4390static const struct btf_kind_operations var_ops = {
4391	.check_meta		= btf_var_check_meta,
4392	.resolve		= btf_var_resolve,
4393	.check_member		= btf_df_check_member,
4394	.check_kflag_member	= btf_df_check_kflag_member,
4395	.log_details		= btf_var_log,
4396	.show			= btf_var_show,
4397};
4398
4399static s32 btf_datasec_check_meta(struct btf_verifier_env *env,
4400				  const struct btf_type *t,
4401				  u32 meta_left)
4402{
4403	const struct btf_var_secinfo *vsi;
4404	u64 last_vsi_end_off = 0, sum = 0;
4405	u32 i, meta_needed;
4406
4407	meta_needed = btf_type_vlen(t) * sizeof(*vsi);
4408	if (meta_left < meta_needed) {
4409		btf_verifier_log_basic(env, t,
4410				       "meta_left:%u meta_needed:%u",
4411				       meta_left, meta_needed);
4412		return -EINVAL;
4413	}
4414
4415	if (!t->size) {
4416		btf_verifier_log_type(env, t, "size == 0");
4417		return -EINVAL;
4418	}
4419
4420	if (btf_type_kflag(t)) {
4421		btf_verifier_log_type(env, t, "Invalid btf_info kind_flag");
4422		return -EINVAL;
4423	}
4424
4425	if (!t->name_off ||
4426	    !btf_name_valid_section(env->btf, t->name_off)) {
4427		btf_verifier_log_type(env, t, "Invalid name");
4428		return -EINVAL;
4429	}
4430
4431	btf_verifier_log_type(env, t, NULL);
4432
4433	for_each_vsi(i, t, vsi) {
4434		/* A var cannot be in type void */
4435		if (!vsi->type || !BTF_TYPE_ID_VALID(vsi->type)) {
4436			btf_verifier_log_vsi(env, t, vsi,
4437					     "Invalid type_id");
4438			return -EINVAL;
4439		}
4440
4441		if (vsi->offset < last_vsi_end_off || vsi->offset >= t->size) {
4442			btf_verifier_log_vsi(env, t, vsi,
4443					     "Invalid offset");
4444			return -EINVAL;
4445		}
4446
4447		if (!vsi->size || vsi->size > t->size) {
4448			btf_verifier_log_vsi(env, t, vsi,
4449					     "Invalid size");
4450			return -EINVAL;
4451		}
4452
4453		last_vsi_end_off = vsi->offset + vsi->size;
4454		if (last_vsi_end_off > t->size) {
4455			btf_verifier_log_vsi(env, t, vsi,
4456					     "Invalid offset+size");
4457			return -EINVAL;
4458		}
4459
4460		btf_verifier_log_vsi(env, t, vsi, NULL);
4461		sum += vsi->size;
4462	}
4463
4464	if (t->size < sum) {
4465		btf_verifier_log_type(env, t, "Invalid btf_info size");
4466		return -EINVAL;
4467	}
4468
4469	return meta_needed;
4470}
4471
4472static int btf_datasec_resolve(struct btf_verifier_env *env,
4473			       const struct resolve_vertex *v)
4474{
4475	const struct btf_var_secinfo *vsi;
4476	struct btf *btf = env->btf;
4477	u16 i;
4478
 
4479	for_each_vsi_from(i, v->next_member, v->t, vsi) {
4480		u32 var_type_id = vsi->type, type_id, type_size = 0;
4481		const struct btf_type *var_type = btf_type_by_id(env->btf,
4482								 var_type_id);
4483		if (!var_type || !btf_type_is_var(var_type)) {
4484			btf_verifier_log_vsi(env, v->t, vsi,
4485					     "Not a VAR kind member");
4486			return -EINVAL;
4487		}
4488
4489		if (!env_type_is_resolve_sink(env, var_type) &&
4490		    !env_type_is_resolved(env, var_type_id)) {
4491			env_stack_set_next_member(env, i + 1);
4492			return env_stack_push(env, var_type, var_type_id);
4493		}
4494
4495		type_id = var_type->type;
4496		if (!btf_type_id_size(btf, &type_id, &type_size)) {
4497			btf_verifier_log_vsi(env, v->t, vsi, "Invalid type");
4498			return -EINVAL;
4499		}
4500
4501		if (vsi->size < type_size) {
4502			btf_verifier_log_vsi(env, v->t, vsi, "Invalid size");
4503			return -EINVAL;
4504		}
4505	}
4506
4507	env_stack_pop_resolved(env, 0, 0);
4508	return 0;
4509}
4510
4511static void btf_datasec_log(struct btf_verifier_env *env,
4512			    const struct btf_type *t)
4513{
4514	btf_verifier_log(env, "size=%u vlen=%u", t->size, btf_type_vlen(t));
4515}
4516
4517static void btf_datasec_show(const struct btf *btf,
4518			     const struct btf_type *t, u32 type_id,
4519			     void *data, u8 bits_offset,
4520			     struct btf_show *show)
4521{
4522	const struct btf_var_secinfo *vsi;
4523	const struct btf_type *var;
4524	u32 i;
4525
4526	if (!btf_show_start_type(show, t, type_id, data))
4527		return;
4528
4529	btf_show_type_value(show, "section (\"%s\") = {",
4530			    __btf_name_by_offset(btf, t->name_off));
4531	for_each_vsi(i, t, vsi) {
4532		var = btf_type_by_id(btf, vsi->type);
4533		if (i)
4534			btf_show(show, ",");
4535		btf_type_ops(var)->show(btf, var, vsi->type,
4536					data + vsi->offset, bits_offset, show);
4537	}
4538	btf_show_end_type(show);
4539}
4540
4541static const struct btf_kind_operations datasec_ops = {
4542	.check_meta		= btf_datasec_check_meta,
4543	.resolve		= btf_datasec_resolve,
4544	.check_member		= btf_df_check_member,
4545	.check_kflag_member	= btf_df_check_kflag_member,
4546	.log_details		= btf_datasec_log,
4547	.show			= btf_datasec_show,
4548};
4549
4550static s32 btf_float_check_meta(struct btf_verifier_env *env,
4551				const struct btf_type *t,
4552				u32 meta_left)
4553{
4554	if (btf_type_vlen(t)) {
4555		btf_verifier_log_type(env, t, "vlen != 0");
4556		return -EINVAL;
4557	}
4558
4559	if (btf_type_kflag(t)) {
4560		btf_verifier_log_type(env, t, "Invalid btf_info kind_flag");
4561		return -EINVAL;
4562	}
4563
4564	if (t->size != 2 && t->size != 4 && t->size != 8 && t->size != 12 &&
4565	    t->size != 16) {
4566		btf_verifier_log_type(env, t, "Invalid type_size");
4567		return -EINVAL;
4568	}
4569
4570	btf_verifier_log_type(env, t, NULL);
4571
4572	return 0;
4573}
4574
4575static int btf_float_check_member(struct btf_verifier_env *env,
4576				  const struct btf_type *struct_type,
4577				  const struct btf_member *member,
4578				  const struct btf_type *member_type)
4579{
4580	u64 start_offset_bytes;
4581	u64 end_offset_bytes;
4582	u64 misalign_bits;
4583	u64 align_bytes;
4584	u64 align_bits;
4585
4586	/* Different architectures have different alignment requirements, so
4587	 * here we check only for the reasonable minimum. This way we ensure
4588	 * that types after CO-RE can pass the kernel BTF verifier.
4589	 */
4590	align_bytes = min_t(u64, sizeof(void *), member_type->size);
4591	align_bits = align_bytes * BITS_PER_BYTE;
4592	div64_u64_rem(member->offset, align_bits, &misalign_bits);
4593	if (misalign_bits) {
4594		btf_verifier_log_member(env, struct_type, member,
4595					"Member is not properly aligned");
4596		return -EINVAL;
4597	}
4598
4599	start_offset_bytes = member->offset / BITS_PER_BYTE;
4600	end_offset_bytes = start_offset_bytes + member_type->size;
4601	if (end_offset_bytes > struct_type->size) {
4602		btf_verifier_log_member(env, struct_type, member,
4603					"Member exceeds struct_size");
4604		return -EINVAL;
4605	}
4606
4607	return 0;
4608}
4609
4610static void btf_float_log(struct btf_verifier_env *env,
4611			  const struct btf_type *t)
4612{
4613	btf_verifier_log(env, "size=%u", t->size);
4614}
4615
4616static const struct btf_kind_operations float_ops = {
4617	.check_meta = btf_float_check_meta,
4618	.resolve = btf_df_resolve,
4619	.check_member = btf_float_check_member,
4620	.check_kflag_member = btf_generic_check_kflag_member,
4621	.log_details = btf_float_log,
4622	.show = btf_df_show,
4623};
4624
4625static s32 btf_decl_tag_check_meta(struct btf_verifier_env *env,
4626			      const struct btf_type *t,
4627			      u32 meta_left)
4628{
4629	const struct btf_decl_tag *tag;
4630	u32 meta_needed = sizeof(*tag);
4631	s32 component_idx;
4632	const char *value;
4633
4634	if (meta_left < meta_needed) {
4635		btf_verifier_log_basic(env, t,
4636				       "meta_left:%u meta_needed:%u",
4637				       meta_left, meta_needed);
4638		return -EINVAL;
4639	}
4640
4641	value = btf_name_by_offset(env->btf, t->name_off);
4642	if (!value || !value[0]) {
4643		btf_verifier_log_type(env, t, "Invalid value");
4644		return -EINVAL;
4645	}
4646
4647	if (btf_type_vlen(t)) {
4648		btf_verifier_log_type(env, t, "vlen != 0");
4649		return -EINVAL;
4650	}
4651
4652	if (btf_type_kflag(t)) {
4653		btf_verifier_log_type(env, t, "Invalid btf_info kind_flag");
4654		return -EINVAL;
4655	}
4656
4657	component_idx = btf_type_decl_tag(t)->component_idx;
4658	if (component_idx < -1) {
4659		btf_verifier_log_type(env, t, "Invalid component_idx");
4660		return -EINVAL;
4661	}
4662
4663	btf_verifier_log_type(env, t, NULL);
4664
4665	return meta_needed;
4666}
4667
4668static int btf_decl_tag_resolve(struct btf_verifier_env *env,
4669			   const struct resolve_vertex *v)
4670{
4671	const struct btf_type *next_type;
4672	const struct btf_type *t = v->t;
4673	u32 next_type_id = t->type;
4674	struct btf *btf = env->btf;
4675	s32 component_idx;
4676	u32 vlen;
4677
4678	next_type = btf_type_by_id(btf, next_type_id);
4679	if (!next_type || !btf_type_is_decl_tag_target(next_type)) {
4680		btf_verifier_log_type(env, v->t, "Invalid type_id");
4681		return -EINVAL;
4682	}
4683
4684	if (!env_type_is_resolve_sink(env, next_type) &&
4685	    !env_type_is_resolved(env, next_type_id))
4686		return env_stack_push(env, next_type, next_type_id);
4687
4688	component_idx = btf_type_decl_tag(t)->component_idx;
4689	if (component_idx != -1) {
4690		if (btf_type_is_var(next_type) || btf_type_is_typedef(next_type)) {
4691			btf_verifier_log_type(env, v->t, "Invalid component_idx");
4692			return -EINVAL;
4693		}
4694
4695		if (btf_type_is_struct(next_type)) {
4696			vlen = btf_type_vlen(next_type);
4697		} else {
4698			/* next_type should be a function */
4699			next_type = btf_type_by_id(btf, next_type->type);
4700			vlen = btf_type_vlen(next_type);
4701		}
4702
4703		if ((u32)component_idx >= vlen) {
4704			btf_verifier_log_type(env, v->t, "Invalid component_idx");
4705			return -EINVAL;
4706		}
4707	}
4708
4709	env_stack_pop_resolved(env, next_type_id, 0);
4710
4711	return 0;
4712}
4713
4714static void btf_decl_tag_log(struct btf_verifier_env *env, const struct btf_type *t)
4715{
4716	btf_verifier_log(env, "type=%u component_idx=%d", t->type,
4717			 btf_type_decl_tag(t)->component_idx);
4718}
4719
4720static const struct btf_kind_operations decl_tag_ops = {
4721	.check_meta = btf_decl_tag_check_meta,
4722	.resolve = btf_decl_tag_resolve,
4723	.check_member = btf_df_check_member,
4724	.check_kflag_member = btf_df_check_kflag_member,
4725	.log_details = btf_decl_tag_log,
4726	.show = btf_df_show,
4727};
4728
4729static int btf_func_proto_check(struct btf_verifier_env *env,
4730				const struct btf_type *t)
4731{
4732	const struct btf_type *ret_type;
4733	const struct btf_param *args;
4734	const struct btf *btf;
4735	u16 nr_args, i;
4736	int err;
4737
4738	btf = env->btf;
4739	args = (const struct btf_param *)(t + 1);
4740	nr_args = btf_type_vlen(t);
4741
4742	/* Check func return type which could be "void" (t->type == 0) */
4743	if (t->type) {
4744		u32 ret_type_id = t->type;
4745
4746		ret_type = btf_type_by_id(btf, ret_type_id);
4747		if (!ret_type) {
4748			btf_verifier_log_type(env, t, "Invalid return type");
4749			return -EINVAL;
4750		}
4751
4752		if (btf_type_is_resolve_source_only(ret_type)) {
4753			btf_verifier_log_type(env, t, "Invalid return type");
4754			return -EINVAL;
4755		}
4756
4757		if (btf_type_needs_resolve(ret_type) &&
4758		    !env_type_is_resolved(env, ret_type_id)) {
4759			err = btf_resolve(env, ret_type, ret_type_id);
4760			if (err)
4761				return err;
4762		}
4763
4764		/* Ensure the return type is a type that has a size */
4765		if (!btf_type_id_size(btf, &ret_type_id, NULL)) {
4766			btf_verifier_log_type(env, t, "Invalid return type");
4767			return -EINVAL;
4768		}
4769	}
4770
4771	if (!nr_args)
4772		return 0;
4773
4774	/* Last func arg type_id could be 0 if it is a vararg */
4775	if (!args[nr_args - 1].type) {
4776		if (args[nr_args - 1].name_off) {
4777			btf_verifier_log_type(env, t, "Invalid arg#%u",
4778					      nr_args);
4779			return -EINVAL;
4780		}
4781		nr_args--;
4782	}
4783
4784	for (i = 0; i < nr_args; i++) {
4785		const struct btf_type *arg_type;
4786		u32 arg_type_id;
4787
4788		arg_type_id = args[i].type;
4789		arg_type = btf_type_by_id(btf, arg_type_id);
4790		if (!arg_type) {
4791			btf_verifier_log_type(env, t, "Invalid arg#%u", i + 1);
4792			return -EINVAL;
4793		}
4794
4795		if (btf_type_is_resolve_source_only(arg_type)) {
4796			btf_verifier_log_type(env, t, "Invalid arg#%u", i + 1);
4797			return -EINVAL;
4798		}
4799
4800		if (args[i].name_off &&
4801		    (!btf_name_offset_valid(btf, args[i].name_off) ||
4802		     !btf_name_valid_identifier(btf, args[i].name_off))) {
4803			btf_verifier_log_type(env, t,
4804					      "Invalid arg#%u", i + 1);
4805			return -EINVAL;
4806		}
4807
4808		if (btf_type_needs_resolve(arg_type) &&
4809		    !env_type_is_resolved(env, arg_type_id)) {
4810			err = btf_resolve(env, arg_type, arg_type_id);
4811			if (err)
4812				return err;
4813		}
4814
4815		if (!btf_type_id_size(btf, &arg_type_id, NULL)) {
4816			btf_verifier_log_type(env, t, "Invalid arg#%u", i + 1);
4817			return -EINVAL;
4818		}
4819	}
4820
4821	return 0;
4822}
4823
4824static int btf_func_check(struct btf_verifier_env *env,
4825			  const struct btf_type *t)
4826{
4827	const struct btf_type *proto_type;
4828	const struct btf_param *args;
4829	const struct btf *btf;
4830	u16 nr_args, i;
4831
4832	btf = env->btf;
4833	proto_type = btf_type_by_id(btf, t->type);
4834
4835	if (!proto_type || !btf_type_is_func_proto(proto_type)) {
4836		btf_verifier_log_type(env, t, "Invalid type_id");
4837		return -EINVAL;
4838	}
4839
4840	args = (const struct btf_param *)(proto_type + 1);
4841	nr_args = btf_type_vlen(proto_type);
4842	for (i = 0; i < nr_args; i++) {
4843		if (!args[i].name_off && args[i].type) {
4844			btf_verifier_log_type(env, t, "Invalid arg#%u", i + 1);
4845			return -EINVAL;
4846		}
4847	}
4848
4849	return 0;
4850}
4851
4852static const struct btf_kind_operations * const kind_ops[NR_BTF_KINDS] = {
4853	[BTF_KIND_INT] = &int_ops,
4854	[BTF_KIND_PTR] = &ptr_ops,
4855	[BTF_KIND_ARRAY] = &array_ops,
4856	[BTF_KIND_STRUCT] = &struct_ops,
4857	[BTF_KIND_UNION] = &struct_ops,
4858	[BTF_KIND_ENUM] = &enum_ops,
4859	[BTF_KIND_FWD] = &fwd_ops,
4860	[BTF_KIND_TYPEDEF] = &modifier_ops,
4861	[BTF_KIND_VOLATILE] = &modifier_ops,
4862	[BTF_KIND_CONST] = &modifier_ops,
4863	[BTF_KIND_RESTRICT] = &modifier_ops,
4864	[BTF_KIND_FUNC] = &func_ops,
4865	[BTF_KIND_FUNC_PROTO] = &func_proto_ops,
4866	[BTF_KIND_VAR] = &var_ops,
4867	[BTF_KIND_DATASEC] = &datasec_ops,
4868	[BTF_KIND_FLOAT] = &float_ops,
4869	[BTF_KIND_DECL_TAG] = &decl_tag_ops,
4870	[BTF_KIND_TYPE_TAG] = &modifier_ops,
4871	[BTF_KIND_ENUM64] = &enum64_ops,
4872};
4873
4874static s32 btf_check_meta(struct btf_verifier_env *env,
4875			  const struct btf_type *t,
4876			  u32 meta_left)
4877{
4878	u32 saved_meta_left = meta_left;
4879	s32 var_meta_size;
4880
4881	if (meta_left < sizeof(*t)) {
4882		btf_verifier_log(env, "[%u] meta_left:%u meta_needed:%zu",
4883				 env->log_type_id, meta_left, sizeof(*t));
4884		return -EINVAL;
4885	}
4886	meta_left -= sizeof(*t);
4887
4888	if (t->info & ~BTF_INFO_MASK) {
4889		btf_verifier_log(env, "[%u] Invalid btf_info:%x",
4890				 env->log_type_id, t->info);
4891		return -EINVAL;
4892	}
4893
4894	if (BTF_INFO_KIND(t->info) > BTF_KIND_MAX ||
4895	    BTF_INFO_KIND(t->info) == BTF_KIND_UNKN) {
4896		btf_verifier_log(env, "[%u] Invalid kind:%u",
4897				 env->log_type_id, BTF_INFO_KIND(t->info));
4898		return -EINVAL;
4899	}
4900
4901	if (!btf_name_offset_valid(env->btf, t->name_off)) {
4902		btf_verifier_log(env, "[%u] Invalid name_offset:%u",
4903				 env->log_type_id, t->name_off);
4904		return -EINVAL;
4905	}
4906
4907	var_meta_size = btf_type_ops(t)->check_meta(env, t, meta_left);
4908	if (var_meta_size < 0)
4909		return var_meta_size;
4910
4911	meta_left -= var_meta_size;
4912
4913	return saved_meta_left - meta_left;
4914}
4915
4916static int btf_check_all_metas(struct btf_verifier_env *env)
4917{
4918	struct btf *btf = env->btf;
4919	struct btf_header *hdr;
4920	void *cur, *end;
4921
4922	hdr = &btf->hdr;
4923	cur = btf->nohdr_data + hdr->type_off;
4924	end = cur + hdr->type_len;
4925
4926	env->log_type_id = btf->base_btf ? btf->start_id : 1;
4927	while (cur < end) {
4928		struct btf_type *t = cur;
4929		s32 meta_size;
4930
4931		meta_size = btf_check_meta(env, t, end - cur);
4932		if (meta_size < 0)
4933			return meta_size;
4934
4935		btf_add_type(env, t);
4936		cur += meta_size;
4937		env->log_type_id++;
4938	}
4939
4940	return 0;
4941}
4942
4943static bool btf_resolve_valid(struct btf_verifier_env *env,
4944			      const struct btf_type *t,
4945			      u32 type_id)
4946{
4947	struct btf *btf = env->btf;
4948
4949	if (!env_type_is_resolved(env, type_id))
4950		return false;
4951
4952	if (btf_type_is_struct(t) || btf_type_is_datasec(t))
4953		return !btf_resolved_type_id(btf, type_id) &&
4954		       !btf_resolved_type_size(btf, type_id);
4955
4956	if (btf_type_is_decl_tag(t) || btf_type_is_func(t))
4957		return btf_resolved_type_id(btf, type_id) &&
4958		       !btf_resolved_type_size(btf, type_id);
4959
4960	if (btf_type_is_modifier(t) || btf_type_is_ptr(t) ||
4961	    btf_type_is_var(t)) {
4962		t = btf_type_id_resolve(btf, &type_id);
4963		return t &&
4964		       !btf_type_is_modifier(t) &&
4965		       !btf_type_is_var(t) &&
4966		       !btf_type_is_datasec(t);
4967	}
4968
4969	if (btf_type_is_array(t)) {
4970		const struct btf_array *array = btf_type_array(t);
4971		const struct btf_type *elem_type;
4972		u32 elem_type_id = array->type;
4973		u32 elem_size;
4974
4975		elem_type = btf_type_id_size(btf, &elem_type_id, &elem_size);
4976		return elem_type && !btf_type_is_modifier(elem_type) &&
4977			(array->nelems * elem_size ==
4978			 btf_resolved_type_size(btf, type_id));
4979	}
4980
4981	return false;
4982}
4983
4984static int btf_resolve(struct btf_verifier_env *env,
4985		       const struct btf_type *t, u32 type_id)
4986{
4987	u32 save_log_type_id = env->log_type_id;
4988	const struct resolve_vertex *v;
4989	int err = 0;
4990
4991	env->resolve_mode = RESOLVE_TBD;
4992	env_stack_push(env, t, type_id);
4993	while (!err && (v = env_stack_peak(env))) {
4994		env->log_type_id = v->type_id;
4995		err = btf_type_ops(v->t)->resolve(env, v);
4996	}
4997
4998	env->log_type_id = type_id;
4999	if (err == -E2BIG) {
5000		btf_verifier_log_type(env, t,
5001				      "Exceeded max resolving depth:%u",
5002				      MAX_RESOLVE_DEPTH);
5003	} else if (err == -EEXIST) {
5004		btf_verifier_log_type(env, t, "Loop detected");
5005	}
5006
5007	/* Final sanity check */
5008	if (!err && !btf_resolve_valid(env, t, type_id)) {
5009		btf_verifier_log_type(env, t, "Invalid resolve state");
5010		err = -EINVAL;
5011	}
5012
5013	env->log_type_id = save_log_type_id;
5014	return err;
5015}
5016
5017static int btf_check_all_types(struct btf_verifier_env *env)
5018{
5019	struct btf *btf = env->btf;
5020	const struct btf_type *t;
5021	u32 type_id, i;
5022	int err;
5023
5024	err = env_resolve_init(env);
5025	if (err)
5026		return err;
5027
5028	env->phase++;
5029	for (i = btf->base_btf ? 0 : 1; i < btf->nr_types; i++) {
5030		type_id = btf->start_id + i;
5031		t = btf_type_by_id(btf, type_id);
5032
5033		env->log_type_id = type_id;
5034		if (btf_type_needs_resolve(t) &&
5035		    !env_type_is_resolved(env, type_id)) {
5036			err = btf_resolve(env, t, type_id);
5037			if (err)
5038				return err;
5039		}
5040
5041		if (btf_type_is_func_proto(t)) {
5042			err = btf_func_proto_check(env, t);
5043			if (err)
5044				return err;
5045		}
5046	}
5047
5048	return 0;
5049}
5050
5051static int btf_parse_type_sec(struct btf_verifier_env *env)
5052{
5053	const struct btf_header *hdr = &env->btf->hdr;
5054	int err;
5055
5056	/* Type section must align to 4 bytes */
5057	if (hdr->type_off & (sizeof(u32) - 1)) {
5058		btf_verifier_log(env, "Unaligned type_off");
5059		return -EINVAL;
5060	}
5061
5062	if (!env->btf->base_btf && !hdr->type_len) {
5063		btf_verifier_log(env, "No type found");
5064		return -EINVAL;
5065	}
5066
5067	err = btf_check_all_metas(env);
5068	if (err)
5069		return err;
5070
5071	return btf_check_all_types(env);
5072}
5073
5074static int btf_parse_str_sec(struct btf_verifier_env *env)
5075{
5076	const struct btf_header *hdr;
5077	struct btf *btf = env->btf;
5078	const char *start, *end;
5079
5080	hdr = &btf->hdr;
5081	start = btf->nohdr_data + hdr->str_off;
5082	end = start + hdr->str_len;
5083
5084	if (end != btf->data + btf->data_size) {
5085		btf_verifier_log(env, "String section is not at the end");
5086		return -EINVAL;
5087	}
5088
5089	btf->strings = start;
5090
5091	if (btf->base_btf && !hdr->str_len)
5092		return 0;
5093	if (!hdr->str_len || hdr->str_len - 1 > BTF_MAX_NAME_OFFSET || end[-1]) {
5094		btf_verifier_log(env, "Invalid string section");
5095		return -EINVAL;
5096	}
5097	if (!btf->base_btf && start[0]) {
5098		btf_verifier_log(env, "Invalid string section");
5099		return -EINVAL;
5100	}
5101
5102	return 0;
5103}
5104
5105static const size_t btf_sec_info_offset[] = {
5106	offsetof(struct btf_header, type_off),
5107	offsetof(struct btf_header, str_off),
5108};
5109
5110static int btf_sec_info_cmp(const void *a, const void *b)
5111{
5112	const struct btf_sec_info *x = a;
5113	const struct btf_sec_info *y = b;
5114
5115	return (int)(x->off - y->off) ? : (int)(x->len - y->len);
5116}
5117
5118static int btf_check_sec_info(struct btf_verifier_env *env,
5119			      u32 btf_data_size)
5120{
5121	struct btf_sec_info secs[ARRAY_SIZE(btf_sec_info_offset)];
5122	u32 total, expected_total, i;
5123	const struct btf_header *hdr;
5124	const struct btf *btf;
5125
5126	btf = env->btf;
5127	hdr = &btf->hdr;
5128
5129	/* Populate the secs from hdr */
5130	for (i = 0; i < ARRAY_SIZE(btf_sec_info_offset); i++)
5131		secs[i] = *(struct btf_sec_info *)((void *)hdr +
5132						   btf_sec_info_offset[i]);
5133
5134	sort(secs, ARRAY_SIZE(btf_sec_info_offset),
5135	     sizeof(struct btf_sec_info), btf_sec_info_cmp, NULL);
5136
5137	/* Check for gaps and overlap among sections */
5138	total = 0;
5139	expected_total = btf_data_size - hdr->hdr_len;
5140	for (i = 0; i < ARRAY_SIZE(btf_sec_info_offset); i++) {
5141		if (expected_total < secs[i].off) {
5142			btf_verifier_log(env, "Invalid section offset");
5143			return -EINVAL;
5144		}
5145		if (total < secs[i].off) {
5146			/* gap */
5147			btf_verifier_log(env, "Unsupported section found");
5148			return -EINVAL;
5149		}
5150		if (total > secs[i].off) {
5151			btf_verifier_log(env, "Section overlap found");
5152			return -EINVAL;
5153		}
5154		if (expected_total - total < secs[i].len) {
5155			btf_verifier_log(env,
5156					 "Total section length too long");
5157			return -EINVAL;
5158		}
5159		total += secs[i].len;
5160	}
5161
5162	/* There is data other than hdr and known sections */
5163	if (expected_total != total) {
5164		btf_verifier_log(env, "Unsupported section found");
5165		return -EINVAL;
5166	}
5167
5168	return 0;
5169}
5170
5171static int btf_parse_hdr(struct btf_verifier_env *env)
5172{
5173	u32 hdr_len, hdr_copy, btf_data_size;
5174	const struct btf_header *hdr;
5175	struct btf *btf;
5176
5177	btf = env->btf;
5178	btf_data_size = btf->data_size;
5179
5180	if (btf_data_size < offsetofend(struct btf_header, hdr_len)) {
5181		btf_verifier_log(env, "hdr_len not found");
5182		return -EINVAL;
5183	}
5184
5185	hdr = btf->data;
5186	hdr_len = hdr->hdr_len;
5187	if (btf_data_size < hdr_len) {
5188		btf_verifier_log(env, "btf_header not found");
5189		return -EINVAL;
5190	}
5191
5192	/* Ensure the unsupported header fields are zero */
5193	if (hdr_len > sizeof(btf->hdr)) {
5194		u8 *expected_zero = btf->data + sizeof(btf->hdr);
5195		u8 *end = btf->data + hdr_len;
5196
5197		for (; expected_zero < end; expected_zero++) {
5198			if (*expected_zero) {
5199				btf_verifier_log(env, "Unsupported btf_header");
5200				return -E2BIG;
5201			}
5202		}
5203	}
5204
5205	hdr_copy = min_t(u32, hdr_len, sizeof(btf->hdr));
5206	memcpy(&btf->hdr, btf->data, hdr_copy);
5207
5208	hdr = &btf->hdr;
5209
5210	btf_verifier_log_hdr(env, btf_data_size);
5211
5212	if (hdr->magic != BTF_MAGIC) {
5213		btf_verifier_log(env, "Invalid magic");
5214		return -EINVAL;
5215	}
5216
5217	if (hdr->version != BTF_VERSION) {
5218		btf_verifier_log(env, "Unsupported version");
5219		return -ENOTSUPP;
5220	}
5221
5222	if (hdr->flags) {
5223		btf_verifier_log(env, "Unsupported flags");
5224		return -ENOTSUPP;
5225	}
5226
5227	if (!btf->base_btf && btf_data_size == hdr->hdr_len) {
5228		btf_verifier_log(env, "No data");
5229		return -EINVAL;
5230	}
5231
5232	return btf_check_sec_info(env, btf_data_size);
5233}
5234
5235static const char *alloc_obj_fields[] = {
5236	"bpf_spin_lock",
5237	"bpf_list_head",
5238	"bpf_list_node",
 
 
 
5239};
5240
5241static struct btf_struct_metas *
5242btf_parse_struct_metas(struct bpf_verifier_log *log, struct btf *btf)
5243{
5244	union {
5245		struct btf_id_set set;
5246		struct {
5247			u32 _cnt;
5248			u32 _ids[ARRAY_SIZE(alloc_obj_fields)];
5249		} _arr;
5250	} aof;
5251	struct btf_struct_metas *tab = NULL;
 
5252	int i, n, id, ret;
5253
5254	BUILD_BUG_ON(offsetof(struct btf_id_set, cnt) != 0);
5255	BUILD_BUG_ON(sizeof(struct btf_id_set) != sizeof(u32));
5256
5257	memset(&aof, 0, sizeof(aof));
 
 
 
 
5258	for (i = 0; i < ARRAY_SIZE(alloc_obj_fields); i++) {
5259		/* Try to find whether this special type exists in user BTF, and
5260		 * if so remember its ID so we can easily find it among members
5261		 * of structs that we iterate in the next loop.
5262		 */
 
 
5263		id = btf_find_by_name_kind(btf, alloc_obj_fields[i], BTF_KIND_STRUCT);
5264		if (id < 0)
5265			continue;
5266		aof.set.ids[aof.set.cnt++] = id;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
5267	}
5268
5269	if (!aof.set.cnt)
 
5270		return NULL;
5271	sort(&aof.set.ids, aof.set.cnt, sizeof(aof.set.ids[0]), btf_id_cmp_func, NULL);
 
5272
5273	n = btf_nr_types(btf);
5274	for (i = 1; i < n; i++) {
5275		struct btf_struct_metas *new_tab;
5276		const struct btf_member *member;
5277		struct btf_field_offs *foffs;
5278		struct btf_struct_meta *type;
5279		struct btf_record *record;
5280		const struct btf_type *t;
5281		int j, tab_cnt;
5282
5283		t = btf_type_by_id(btf, i);
5284		if (!t) {
5285			ret = -EINVAL;
5286			goto free;
5287		}
5288		if (!__btf_type_is_struct(t))
5289			continue;
5290
5291		cond_resched();
5292
5293		for_each_member(j, t, member) {
5294			if (btf_id_set_contains(&aof.set, member->type))
5295				goto parse;
5296		}
5297		continue;
5298	parse:
5299		tab_cnt = tab ? tab->cnt : 0;
5300		new_tab = krealloc(tab, offsetof(struct btf_struct_metas, types[tab_cnt + 1]),
5301				   GFP_KERNEL | __GFP_NOWARN);
5302		if (!new_tab) {
5303			ret = -ENOMEM;
5304			goto free;
5305		}
5306		if (!tab)
5307			new_tab->cnt = 0;
5308		tab = new_tab;
5309
5310		type = &tab->types[tab->cnt];
5311		type->btf_id = i;
5312		record = btf_parse_fields(btf, t, BPF_SPIN_LOCK | BPF_LIST_HEAD | BPF_LIST_NODE, t->size);
 
 
5313		/* The record cannot be unset, treat it as an error if so */
5314		if (IS_ERR_OR_NULL(record)) {
5315			ret = PTR_ERR_OR_ZERO(record) ?: -EFAULT;
5316			goto free;
5317		}
5318		foffs = btf_parse_field_offs(record);
5319		/* We need the field_offs to be valid for a valid record,
5320		 * either both should be set or both should be unset.
5321		 */
5322		if (IS_ERR_OR_NULL(foffs)) {
5323			btf_record_free(record);
5324			ret = -EFAULT;
5325			goto free;
5326		}
5327		type->record = record;
5328		type->field_offs = foffs;
5329		tab->cnt++;
5330	}
 
5331	return tab;
5332free:
5333	btf_struct_metas_free(tab);
 
 
5334	return ERR_PTR(ret);
5335}
5336
5337struct btf_struct_meta *btf_find_struct_meta(const struct btf *btf, u32 btf_id)
5338{
5339	struct btf_struct_metas *tab;
5340
5341	BUILD_BUG_ON(offsetof(struct btf_struct_meta, btf_id) != 0);
5342	tab = btf->struct_meta_tab;
5343	if (!tab)
5344		return NULL;
5345	return bsearch(&btf_id, tab->types, tab->cnt, sizeof(tab->types[0]), btf_id_cmp_func);
5346}
5347
5348static int btf_check_type_tags(struct btf_verifier_env *env,
5349			       struct btf *btf, int start_id)
5350{
5351	int i, n, good_id = start_id - 1;
5352	bool in_tags;
5353
5354	n = btf_nr_types(btf);
5355	for (i = start_id; i < n; i++) {
5356		const struct btf_type *t;
5357		int chain_limit = 32;
5358		u32 cur_id = i;
5359
5360		t = btf_type_by_id(btf, i);
5361		if (!t)
5362			return -EINVAL;
5363		if (!btf_type_is_modifier(t))
5364			continue;
5365
5366		cond_resched();
5367
5368		in_tags = btf_type_is_type_tag(t);
5369		while (btf_type_is_modifier(t)) {
5370			if (!chain_limit--) {
5371				btf_verifier_log(env, "Max chain length or cycle detected");
5372				return -ELOOP;
5373			}
5374			if (btf_type_is_type_tag(t)) {
5375				if (!in_tags) {
5376					btf_verifier_log(env, "Type tags don't precede modifiers");
5377					return -EINVAL;
5378				}
5379			} else if (in_tags) {
5380				in_tags = false;
5381			}
5382			if (cur_id <= good_id)
5383				break;
5384			/* Move to next type */
5385			cur_id = t->type;
5386			t = btf_type_by_id(btf, cur_id);
5387			if (!t)
5388				return -EINVAL;
5389		}
5390		good_id = i;
5391	}
5392	return 0;
5393}
5394
5395static struct btf *btf_parse(bpfptr_t btf_data, u32 btf_data_size,
5396			     u32 log_level, char __user *log_ubuf, u32 log_size)
5397{
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
5398	struct btf_struct_metas *struct_meta_tab;
5399	struct btf_verifier_env *env = NULL;
5400	struct bpf_verifier_log *log;
5401	struct btf *btf = NULL;
5402	u8 *data;
5403	int err;
5404
5405	if (btf_data_size > BTF_MAX_SIZE)
5406		return ERR_PTR(-E2BIG);
5407
5408	env = kzalloc(sizeof(*env), GFP_KERNEL | __GFP_NOWARN);
5409	if (!env)
5410		return ERR_PTR(-ENOMEM);
5411
5412	log = &env->log;
5413	if (log_level || log_ubuf || log_size) {
5414		/* user requested verbose verifier output
5415		 * and supplied buffer to store the verification trace
5416		 */
5417		log->level = log_level;
5418		log->ubuf = log_ubuf;
5419		log->len_total = log_size;
5420
5421		/* log attributes have to be sane */
5422		if (!bpf_verifier_log_attr_valid(log)) {
5423			err = -EINVAL;
5424			goto errout;
5425		}
5426	}
5427
5428	btf = kzalloc(sizeof(*btf), GFP_KERNEL | __GFP_NOWARN);
5429	if (!btf) {
5430		err = -ENOMEM;
5431		goto errout;
5432	}
5433	env->btf = btf;
5434
5435	data = kvmalloc(btf_data_size, GFP_KERNEL | __GFP_NOWARN);
5436	if (!data) {
5437		err = -ENOMEM;
5438		goto errout;
5439	}
5440
5441	btf->data = data;
5442	btf->data_size = btf_data_size;
5443
5444	if (copy_from_bpfptr(data, btf_data, btf_data_size)) {
5445		err = -EFAULT;
5446		goto errout;
5447	}
5448
5449	err = btf_parse_hdr(env);
5450	if (err)
5451		goto errout;
5452
5453	btf->nohdr_data = btf->data + btf->hdr.hdr_len;
5454
5455	err = btf_parse_str_sec(env);
5456	if (err)
5457		goto errout;
5458
5459	err = btf_parse_type_sec(env);
5460	if (err)
5461		goto errout;
5462
5463	err = btf_check_type_tags(env, btf, 1);
5464	if (err)
5465		goto errout;
5466
5467	struct_meta_tab = btf_parse_struct_metas(log, btf);
5468	if (IS_ERR(struct_meta_tab)) {
5469		err = PTR_ERR(struct_meta_tab);
5470		goto errout;
5471	}
5472	btf->struct_meta_tab = struct_meta_tab;
5473
5474	if (struct_meta_tab) {
5475		int i;
5476
5477		for (i = 0; i < struct_meta_tab->cnt; i++) {
5478			err = btf_check_and_fixup_fields(btf, struct_meta_tab->types[i].record);
5479			if (err < 0)
5480				goto errout_meta;
5481		}
5482	}
5483
5484	if (log->level && bpf_verifier_log_full(log)) {
5485		err = -ENOSPC;
5486		goto errout_meta;
5487	}
5488
5489	btf_verifier_env_free(env);
5490	refcount_set(&btf->refcnt, 1);
5491	return btf;
5492
5493errout_meta:
5494	btf_free_struct_meta_tab(btf);
5495errout:
 
 
 
 
 
5496	btf_verifier_env_free(env);
5497	if (btf)
5498		btf_free(btf);
5499	return ERR_PTR(err);
5500}
5501
5502extern char __weak __start_BTF[];
5503extern char __weak __stop_BTF[];
5504extern struct btf *btf_vmlinux;
5505
5506#define BPF_MAP_TYPE(_id, _ops)
5507#define BPF_LINK_TYPE(_id, _name)
5508static union {
5509	struct bpf_ctx_convert {
5510#define BPF_PROG_TYPE(_id, _name, prog_ctx_type, kern_ctx_type) \
5511	prog_ctx_type _id##_prog; \
5512	kern_ctx_type _id##_kern;
5513#include <linux/bpf_types.h>
5514#undef BPF_PROG_TYPE
5515	} *__t;
5516	/* 't' is written once under lock. Read many times. */
5517	const struct btf_type *t;
5518} bpf_ctx_convert;
5519enum {
5520#define BPF_PROG_TYPE(_id, _name, prog_ctx_type, kern_ctx_type) \
5521	__ctx_convert##_id,
5522#include <linux/bpf_types.h>
5523#undef BPF_PROG_TYPE
5524	__ctx_convert_unused, /* to avoid empty enum in extreme .config */
5525};
5526static u8 bpf_ctx_convert_map[] = {
5527#define BPF_PROG_TYPE(_id, _name, prog_ctx_type, kern_ctx_type) \
5528	[_id] = __ctx_convert##_id,
5529#include <linux/bpf_types.h>
5530#undef BPF_PROG_TYPE
5531	0, /* avoid empty array */
5532};
5533#undef BPF_MAP_TYPE
5534#undef BPF_LINK_TYPE
5535
5536const struct btf_member *
5537btf_get_prog_ctx_type(struct bpf_verifier_log *log, const struct btf *btf,
5538		      const struct btf_type *t, enum bpf_prog_type prog_type,
5539		      int arg)
5540{
5541	const struct btf_type *conv_struct;
5542	const struct btf_type *ctx_struct;
5543	const struct btf_member *ctx_type;
5544	const char *tname, *ctx_tname;
5545
5546	conv_struct = bpf_ctx_convert.t;
5547	if (!conv_struct) {
5548		bpf_log(log, "btf_vmlinux is malformed\n");
5549		return NULL;
5550	}
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
5551	t = btf_type_by_id(btf, t->type);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
5552	while (btf_type_is_modifier(t))
5553		t = btf_type_by_id(btf, t->type);
5554	if (!btf_type_is_struct(t)) {
5555		/* Only pointer to struct is supported for now.
5556		 * That means that BPF_PROG_TYPE_TRACEPOINT with BTF
5557		 * is not supported yet.
5558		 * BPF_PROG_TYPE_RAW_TRACEPOINT is fine.
5559		 */
5560		return NULL;
5561	}
5562	tname = btf_name_by_offset(btf, t->name_off);
5563	if (!tname) {
5564		bpf_log(log, "arg#%d struct doesn't have a name\n", arg);
5565		return NULL;
5566	}
5567	/* prog_type is valid bpf program type. No need for bounds check. */
5568	ctx_type = btf_type_member(conv_struct) + bpf_ctx_convert_map[prog_type] * 2;
5569	/* ctx_struct is a pointer to prog_ctx_type in vmlinux.
5570	 * Like 'struct __sk_buff'
5571	 */
5572	ctx_struct = btf_type_by_id(btf_vmlinux, ctx_type->type);
5573	if (!ctx_struct)
5574		/* should not happen */
5575		return NULL;
5576	ctx_tname = btf_name_by_offset(btf_vmlinux, ctx_struct->name_off);
 
 
5577	if (!ctx_tname) {
5578		/* should not happen */
5579		bpf_log(log, "Please fix kernel include/linux/bpf_types.h\n");
5580		return NULL;
5581	}
 
 
 
5582	/* only compare that prog's ctx type name is the same as
5583	 * kernel expects. No need to compare field by field.
5584	 * It's ok for bpf prog to do:
5585	 * struct __sk_buff {};
5586	 * int socket_filter_bpf_prog(struct __sk_buff *skb)
5587	 * { // no fields of skb are ever used }
5588	 */
5589	if (strcmp(ctx_tname, tname))
5590		return NULL;
5591	return ctx_type;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
5592}
5593
5594static int btf_translate_to_vmlinux(struct bpf_verifier_log *log,
5595				     struct btf *btf,
5596				     const struct btf_type *t,
5597				     enum bpf_prog_type prog_type,
5598				     int arg)
5599{
5600	const struct btf_member *prog_ctx_type, *kern_ctx_type;
5601
5602	prog_ctx_type = btf_get_prog_ctx_type(log, btf, t, prog_type, arg);
5603	if (!prog_ctx_type)
5604		return -ENOENT;
5605	kern_ctx_type = prog_ctx_type + 1;
5606	return kern_ctx_type->type;
5607}
5608
5609int get_kern_ctx_btf_id(struct bpf_verifier_log *log, enum bpf_prog_type prog_type)
5610{
5611	const struct btf_member *kctx_member;
5612	const struct btf_type *conv_struct;
5613	const struct btf_type *kctx_type;
5614	u32 kctx_type_id;
5615
5616	conv_struct = bpf_ctx_convert.t;
5617	/* get member for kernel ctx type */
5618	kctx_member = btf_type_member(conv_struct) + bpf_ctx_convert_map[prog_type] * 2 + 1;
5619	kctx_type_id = kctx_member->type;
5620	kctx_type = btf_type_by_id(btf_vmlinux, kctx_type_id);
5621	if (!btf_type_is_struct(kctx_type)) {
5622		bpf_log(log, "kern ctx type id %u is not a struct\n", kctx_type_id);
5623		return -EINVAL;
5624	}
5625
5626	return kctx_type_id;
5627}
5628
5629BTF_ID_LIST(bpf_ctx_convert_btf_id)
5630BTF_ID(struct, bpf_ctx_convert)
5631
5632struct btf *btf_parse_vmlinux(void)
 
5633{
5634	struct btf_verifier_env *env = NULL;
5635	struct bpf_verifier_log *log;
5636	struct btf *btf = NULL;
5637	int err;
5638
5639	env = kzalloc(sizeof(*env), GFP_KERNEL | __GFP_NOWARN);
5640	if (!env)
5641		return ERR_PTR(-ENOMEM);
5642
5643	log = &env->log;
5644	log->level = BPF_LOG_KERNEL;
5645
5646	btf = kzalloc(sizeof(*btf), GFP_KERNEL | __GFP_NOWARN);
5647	if (!btf) {
5648		err = -ENOMEM;
5649		goto errout;
5650	}
5651	env->btf = btf;
5652
5653	btf->data = __start_BTF;
5654	btf->data_size = __stop_BTF - __start_BTF;
5655	btf->kernel_btf = true;
5656	snprintf(btf->name, sizeof(btf->name), "vmlinux");
5657
5658	err = btf_parse_hdr(env);
5659	if (err)
5660		goto errout;
5661
5662	btf->nohdr_data = btf->data + btf->hdr.hdr_len;
5663
5664	err = btf_parse_str_sec(env);
5665	if (err)
5666		goto errout;
5667
5668	err = btf_check_all_metas(env);
5669	if (err)
5670		goto errout;
5671
5672	err = btf_check_type_tags(env, btf, 1);
5673	if (err)
5674		goto errout;
5675
5676	/* btf_parse_vmlinux() runs under bpf_verifier_lock */
5677	bpf_ctx_convert.t = btf_type_by_id(btf, bpf_ctx_convert_btf_id[0]);
5678
5679	bpf_struct_ops_init(btf, log);
5680
5681	refcount_set(&btf->refcnt, 1);
5682
5683	err = btf_alloc_id(btf);
5684	if (err)
5685		goto errout;
5686
5687	btf_verifier_env_free(env);
5688	return btf;
5689
5690errout:
5691	btf_verifier_env_free(env);
5692	if (btf) {
5693		kvfree(btf->types);
5694		kfree(btf);
5695	}
5696	return ERR_PTR(err);
5697}
5698
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
5699#ifdef CONFIG_DEBUG_INFO_BTF_MODULES
5700
5701static struct btf *btf_parse_module(const char *module_name, const void *data, unsigned int data_size)
 
 
5702{
 
5703	struct btf_verifier_env *env = NULL;
5704	struct bpf_verifier_log *log;
5705	struct btf *btf = NULL, *base_btf;
5706	int err;
5707
5708	base_btf = bpf_get_btf_vmlinux();
5709	if (IS_ERR(base_btf))
5710		return base_btf;
5711	if (!base_btf)
5712		return ERR_PTR(-EINVAL);
5713
5714	env = kzalloc(sizeof(*env), GFP_KERNEL | __GFP_NOWARN);
5715	if (!env)
5716		return ERR_PTR(-ENOMEM);
5717
5718	log = &env->log;
5719	log->level = BPF_LOG_KERNEL;
5720
 
 
 
 
 
 
 
 
 
 
5721	btf = kzalloc(sizeof(*btf), GFP_KERNEL | __GFP_NOWARN);
5722	if (!btf) {
5723		err = -ENOMEM;
5724		goto errout;
5725	}
5726	env->btf = btf;
5727
5728	btf->base_btf = base_btf;
5729	btf->start_id = base_btf->nr_types;
5730	btf->start_str_off = base_btf->hdr.str_len;
5731	btf->kernel_btf = true;
5732	snprintf(btf->name, sizeof(btf->name), "%s", module_name);
5733
5734	btf->data = kvmalloc(data_size, GFP_KERNEL | __GFP_NOWARN);
5735	if (!btf->data) {
5736		err = -ENOMEM;
5737		goto errout;
5738	}
5739	memcpy(btf->data, data, data_size);
5740	btf->data_size = data_size;
5741
5742	err = btf_parse_hdr(env);
5743	if (err)
5744		goto errout;
5745
5746	btf->nohdr_data = btf->data + btf->hdr.hdr_len;
5747
5748	err = btf_parse_str_sec(env);
5749	if (err)
5750		goto errout;
5751
5752	err = btf_check_all_metas(env);
5753	if (err)
5754		goto errout;
5755
5756	err = btf_check_type_tags(env, btf, btf_nr_types(base_btf));
5757	if (err)
5758		goto errout;
5759
 
 
 
 
 
 
 
 
5760	btf_verifier_env_free(env);
5761	refcount_set(&btf->refcnt, 1);
5762	return btf;
5763
5764errout:
5765	btf_verifier_env_free(env);
 
 
5766	if (btf) {
5767		kvfree(btf->data);
5768		kvfree(btf->types);
5769		kfree(btf);
5770	}
5771	return ERR_PTR(err);
5772}
5773
5774#endif /* CONFIG_DEBUG_INFO_BTF_MODULES */
5775
5776struct btf *bpf_prog_get_target_btf(const struct bpf_prog *prog)
5777{
5778	struct bpf_prog *tgt_prog = prog->aux->dst_prog;
5779
5780	if (tgt_prog)
5781		return tgt_prog->aux->btf;
5782	else
5783		return prog->aux->attach_btf;
5784}
5785
5786static bool is_int_ptr(struct btf *btf, const struct btf_type *t)
5787{
5788	/* t comes in already as a pointer */
5789	t = btf_type_by_id(btf, t->type);
5790
5791	/* allow const */
5792	if (BTF_INFO_KIND(t->info) == BTF_KIND_CONST)
5793		t = btf_type_by_id(btf, t->type);
5794
5795	return btf_type_is_int(t);
5796}
5797
5798static u32 get_ctx_arg_idx(struct btf *btf, const struct btf_type *func_proto,
5799			   int off)
5800{
5801	const struct btf_param *args;
5802	const struct btf_type *t;
5803	u32 offset = 0, nr_args;
5804	int i;
5805
5806	if (!func_proto)
5807		return off / 8;
5808
5809	nr_args = btf_type_vlen(func_proto);
5810	args = (const struct btf_param *)(func_proto + 1);
5811	for (i = 0; i < nr_args; i++) {
5812		t = btf_type_skip_modifiers(btf, args[i].type, NULL);
5813		offset += btf_type_is_ptr(t) ? 8 : roundup(t->size, 8);
5814		if (off < offset)
5815			return i;
5816	}
5817
5818	t = btf_type_skip_modifiers(btf, func_proto->type, NULL);
5819	offset += btf_type_is_ptr(t) ? 8 : roundup(t->size, 8);
5820	if (off < offset)
5821		return nr_args;
5822
5823	return nr_args + 1;
5824}
5825
5826static bool prog_args_trusted(const struct bpf_prog *prog)
5827{
5828	enum bpf_attach_type atype = prog->expected_attach_type;
5829
5830	switch (prog->type) {
5831	case BPF_PROG_TYPE_TRACING:
5832		return atype == BPF_TRACE_RAW_TP || atype == BPF_TRACE_ITER;
5833	case BPF_PROG_TYPE_LSM:
5834		return bpf_lsm_is_trusted(prog);
5835	case BPF_PROG_TYPE_STRUCT_OPS:
5836		return true;
5837	default:
5838		return false;
5839	}
5840}
5841
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
5842bool btf_ctx_access(int off, int size, enum bpf_access_type type,
5843		    const struct bpf_prog *prog,
5844		    struct bpf_insn_access_aux *info)
5845{
5846	const struct btf_type *t = prog->aux->attach_func_proto;
5847	struct bpf_prog *tgt_prog = prog->aux->dst_prog;
5848	struct btf *btf = bpf_prog_get_target_btf(prog);
5849	const char *tname = prog->aux->attach_func_name;
5850	struct bpf_verifier_log *log = info->log;
5851	const struct btf_param *args;
 
5852	const char *tag_value;
5853	u32 nr_args, arg;
5854	int i, ret;
5855
5856	if (off % 8) {
5857		bpf_log(log, "func '%s' offset %d is not multiple of 8\n",
5858			tname, off);
5859		return false;
5860	}
5861	arg = get_ctx_arg_idx(btf, t, off);
5862	args = (const struct btf_param *)(t + 1);
5863	/* if (t == NULL) Fall back to default BPF prog with
5864	 * MAX_BPF_FUNC_REG_ARGS u64 arguments.
5865	 */
5866	nr_args = t ? btf_type_vlen(t) : MAX_BPF_FUNC_REG_ARGS;
5867	if (prog->aux->attach_btf_trace) {
5868		/* skip first 'void *__data' argument in btf_trace_##name typedef */
5869		args++;
5870		nr_args--;
5871	}
5872
5873	if (arg > nr_args) {
5874		bpf_log(log, "func '%s' doesn't have %d-th argument\n",
5875			tname, arg + 1);
5876		return false;
5877	}
5878
5879	if (arg == nr_args) {
5880		switch (prog->expected_attach_type) {
5881		case BPF_LSM_CGROUP:
5882		case BPF_LSM_MAC:
 
 
 
 
5883		case BPF_TRACE_FEXIT:
5884			/* When LSM programs are attached to void LSM hooks
5885			 * they use FEXIT trampolines and when attached to
5886			 * int LSM hooks, they use MODIFY_RETURN trampolines.
5887			 *
5888			 * While the LSM programs are BPF_MODIFY_RETURN-like
5889			 * the check:
5890			 *
5891			 *	if (ret_type != 'int')
5892			 *		return -EINVAL;
5893			 *
5894			 * is _not_ done here. This is still safe as LSM hooks
5895			 * have only void and int return types.
5896			 */
5897			if (!t)
5898				return true;
5899			t = btf_type_by_id(btf, t->type);
5900			break;
5901		case BPF_MODIFY_RETURN:
5902			/* For now the BPF_MODIFY_RETURN can only be attached to
5903			 * functions that return an int.
5904			 */
5905			if (!t)
5906				return false;
5907
5908			t = btf_type_skip_modifiers(btf, t->type, NULL);
5909			if (!btf_type_is_small_int(t)) {
5910				bpf_log(log,
5911					"ret type %s not allowed for fmod_ret\n",
5912					btf_type_str(t));
5913				return false;
5914			}
5915			break;
5916		default:
5917			bpf_log(log, "func '%s' doesn't have %d-th argument\n",
5918				tname, arg + 1);
5919			return false;
5920		}
5921	} else {
5922		if (!t)
5923			/* Default prog with MAX_BPF_FUNC_REG_ARGS args */
5924			return true;
5925		t = btf_type_by_id(btf, args[arg].type);
5926	}
5927
5928	/* skip modifiers */
5929	while (btf_type_is_modifier(t))
5930		t = btf_type_by_id(btf, t->type);
5931	if (btf_type_is_small_int(t) || btf_is_any_enum(t) || __btf_type_is_struct(t))
5932		/* accessing a scalar */
5933		return true;
5934	if (!btf_type_is_ptr(t)) {
5935		bpf_log(log,
5936			"func '%s' arg%d '%s' has type %s. Only pointer access is allowed\n",
5937			tname, arg,
5938			__btf_name_by_offset(btf, t->name_off),
5939			btf_type_str(t));
5940		return false;
5941	}
5942
 
 
 
 
 
 
5943	/* check for PTR_TO_RDONLY_BUF_OR_NULL or PTR_TO_RDWR_BUF_OR_NULL */
5944	for (i = 0; i < prog->aux->ctx_arg_info_size; i++) {
5945		const struct bpf_ctx_arg_aux *ctx_arg_info = &prog->aux->ctx_arg_info[i];
5946		u32 type, flag;
5947
5948		type = base_type(ctx_arg_info->reg_type);
5949		flag = type_flag(ctx_arg_info->reg_type);
5950		if (ctx_arg_info->offset == off && type == PTR_TO_BUF &&
5951		    (flag & PTR_MAYBE_NULL)) {
5952			info->reg_type = ctx_arg_info->reg_type;
5953			return true;
5954		}
5955	}
5956
5957	if (t->type == 0)
5958		/* This is a pointer to void.
5959		 * It is the same as scalar from the verifier safety pov.
5960		 * No further pointer walking is allowed.
5961		 */
5962		return true;
5963
5964	if (is_int_ptr(btf, t))
5965		return true;
5966
5967	/* this is a pointer to another type */
5968	for (i = 0; i < prog->aux->ctx_arg_info_size; i++) {
5969		const struct bpf_ctx_arg_aux *ctx_arg_info = &prog->aux->ctx_arg_info[i];
5970
5971		if (ctx_arg_info->offset == off) {
5972			if (!ctx_arg_info->btf_id) {
5973				bpf_log(log,"invalid btf_id for context argument offset %u\n", off);
5974				return false;
5975			}
5976
5977			info->reg_type = ctx_arg_info->reg_type;
5978			info->btf = btf_vmlinux;
5979			info->btf_id = ctx_arg_info->btf_id;
5980			return true;
5981		}
5982	}
5983
5984	info->reg_type = PTR_TO_BTF_ID;
5985	if (prog_args_trusted(prog))
5986		info->reg_type |= PTR_TRUSTED;
5987
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
5988	if (tgt_prog) {
5989		enum bpf_prog_type tgt_type;
5990
5991		if (tgt_prog->type == BPF_PROG_TYPE_EXT)
5992			tgt_type = tgt_prog->aux->saved_dst_prog_type;
5993		else
5994			tgt_type = tgt_prog->type;
5995
5996		ret = btf_translate_to_vmlinux(log, btf, t, tgt_type, arg);
5997		if (ret > 0) {
5998			info->btf = btf_vmlinux;
5999			info->btf_id = ret;
6000			return true;
6001		} else {
6002			return false;
6003		}
6004	}
6005
6006	info->btf = btf;
6007	info->btf_id = t->type;
6008	t = btf_type_by_id(btf, t->type);
6009
6010	if (btf_type_is_type_tag(t)) {
6011		tag_value = __btf_name_by_offset(btf, t->name_off);
6012		if (strcmp(tag_value, "user") == 0)
6013			info->reg_type |= MEM_USER;
6014		if (strcmp(tag_value, "percpu") == 0)
6015			info->reg_type |= MEM_PERCPU;
6016	}
6017
6018	/* skip modifiers */
6019	while (btf_type_is_modifier(t)) {
6020		info->btf_id = t->type;
6021		t = btf_type_by_id(btf, t->type);
6022	}
6023	if (!btf_type_is_struct(t)) {
6024		bpf_log(log,
6025			"func '%s' arg%d type %s is not a struct\n",
6026			tname, arg, btf_type_str(t));
6027		return false;
6028	}
6029	bpf_log(log, "func '%s' arg%d has btf_id %d type %s '%s'\n",
6030		tname, arg, info->btf_id, btf_type_str(t),
6031		__btf_name_by_offset(btf, t->name_off));
 
 
 
 
 
 
 
 
 
6032	return true;
6033}
 
6034
6035enum bpf_struct_walk_result {
6036	/* < 0 error */
6037	WALK_SCALAR = 0,
6038	WALK_PTR,
6039	WALK_STRUCT,
6040};
6041
6042static int btf_struct_walk(struct bpf_verifier_log *log, const struct btf *btf,
6043			   const struct btf_type *t, int off, int size,
6044			   u32 *next_btf_id, enum bpf_type_flag *flag)
 
6045{
6046	u32 i, moff, mtrue_end, msize = 0, total_nelems = 0;
6047	const struct btf_type *mtype, *elem_type = NULL;
6048	const struct btf_member *member;
6049	const char *tname, *mname, *tag_value;
6050	u32 vlen, elem_id, mid;
6051
6052again:
 
 
6053	tname = __btf_name_by_offset(btf, t->name_off);
6054	if (!btf_type_is_struct(t)) {
6055		bpf_log(log, "Type '%s' is not a struct\n", tname);
6056		return -EINVAL;
6057	}
6058
6059	vlen = btf_type_vlen(t);
 
 
 
 
 
 
 
 
6060	if (off + size > t->size) {
6061		/* If the last element is a variable size array, we may
6062		 * need to relax the rule.
6063		 */
6064		struct btf_array *array_elem;
6065
6066		if (vlen == 0)
6067			goto error;
6068
6069		member = btf_type_member(t) + vlen - 1;
6070		mtype = btf_type_skip_modifiers(btf, member->type,
6071						NULL);
6072		if (!btf_type_is_array(mtype))
6073			goto error;
6074
6075		array_elem = (struct btf_array *)(mtype + 1);
6076		if (array_elem->nelems != 0)
6077			goto error;
6078
6079		moff = __btf_member_bit_offset(t, member) / 8;
6080		if (off < moff)
6081			goto error;
6082
6083		/* Only allow structure for now, can be relaxed for
6084		 * other types later.
6085		 */
6086		t = btf_type_skip_modifiers(btf, array_elem->type,
6087					    NULL);
 
 
 
 
6088		if (!btf_type_is_struct(t))
6089			goto error;
6090
6091		off = (off - moff) % t->size;
6092		goto again;
6093
6094error:
6095		bpf_log(log, "access beyond struct %s at off %u size %u\n",
6096			tname, off, size);
6097		return -EACCES;
6098	}
6099
6100	for_each_member(i, t, member) {
6101		/* offset of the field in bytes */
6102		moff = __btf_member_bit_offset(t, member) / 8;
6103		if (off + size <= moff)
6104			/* won't find anything, field is already too far */
6105			break;
6106
6107		if (__btf_member_bitfield_size(t, member)) {
6108			u32 end_bit = __btf_member_bit_offset(t, member) +
6109				__btf_member_bitfield_size(t, member);
6110
6111			/* off <= moff instead of off == moff because clang
6112			 * does not generate a BTF member for anonymous
6113			 * bitfield like the ":16" here:
6114			 * struct {
6115			 *	int :16;
6116			 *	int x:8;
6117			 * };
6118			 */
6119			if (off <= moff &&
6120			    BITS_ROUNDUP_BYTES(end_bit) <= off + size)
6121				return WALK_SCALAR;
6122
6123			/* off may be accessing a following member
6124			 *
6125			 * or
6126			 *
6127			 * Doing partial access at either end of this
6128			 * bitfield.  Continue on this case also to
6129			 * treat it as not accessing this bitfield
6130			 * and eventually error out as field not
6131			 * found to keep it simple.
6132			 * It could be relaxed if there was a legit
6133			 * partial access case later.
6134			 */
6135			continue;
6136		}
6137
6138		/* In case of "off" is pointing to holes of a struct */
6139		if (off < moff)
6140			break;
6141
6142		/* type of the field */
6143		mid = member->type;
6144		mtype = btf_type_by_id(btf, member->type);
6145		mname = __btf_name_by_offset(btf, member->name_off);
6146
6147		mtype = __btf_resolve_size(btf, mtype, &msize,
6148					   &elem_type, &elem_id, &total_nelems,
6149					   &mid);
6150		if (IS_ERR(mtype)) {
6151			bpf_log(log, "field %s doesn't have size\n", mname);
6152			return -EFAULT;
6153		}
6154
6155		mtrue_end = moff + msize;
6156		if (off >= mtrue_end)
6157			/* no overlap with member, keep iterating */
6158			continue;
6159
6160		if (btf_type_is_array(mtype)) {
6161			u32 elem_idx;
6162
6163			/* __btf_resolve_size() above helps to
6164			 * linearize a multi-dimensional array.
6165			 *
6166			 * The logic here is treating an array
6167			 * in a struct as the following way:
6168			 *
6169			 * struct outer {
6170			 *	struct inner array[2][2];
6171			 * };
6172			 *
6173			 * looks like:
6174			 *
6175			 * struct outer {
6176			 *	struct inner array_elem0;
6177			 *	struct inner array_elem1;
6178			 *	struct inner array_elem2;
6179			 *	struct inner array_elem3;
6180			 * };
6181			 *
6182			 * When accessing outer->array[1][0], it moves
6183			 * moff to "array_elem2", set mtype to
6184			 * "struct inner", and msize also becomes
6185			 * sizeof(struct inner).  Then most of the
6186			 * remaining logic will fall through without
6187			 * caring the current member is an array or
6188			 * not.
6189			 *
6190			 * Unlike mtype/msize/moff, mtrue_end does not
6191			 * change.  The naming difference ("_true") tells
6192			 * that it is not always corresponding to
6193			 * the current mtype/msize/moff.
6194			 * It is the true end of the current
6195			 * member (i.e. array in this case).  That
6196			 * will allow an int array to be accessed like
6197			 * a scratch space,
6198			 * i.e. allow access beyond the size of
6199			 *      the array's element as long as it is
6200			 *      within the mtrue_end boundary.
6201			 */
6202
6203			/* skip empty array */
6204			if (moff == mtrue_end)
6205				continue;
6206
6207			msize /= total_nelems;
6208			elem_idx = (off - moff) / msize;
6209			moff += elem_idx * msize;
6210			mtype = elem_type;
6211			mid = elem_id;
6212		}
6213
6214		/* the 'off' we're looking for is either equal to start
6215		 * of this field or inside of this struct
6216		 */
6217		if (btf_type_is_struct(mtype)) {
6218			/* our field must be inside that union or struct */
6219			t = mtype;
6220
6221			/* return if the offset matches the member offset */
6222			if (off == moff) {
6223				*next_btf_id = mid;
6224				return WALK_STRUCT;
6225			}
6226
6227			/* adjust offset we're looking for */
6228			off -= moff;
6229			goto again;
6230		}
6231
6232		if (btf_type_is_ptr(mtype)) {
6233			const struct btf_type *stype, *t;
6234			enum bpf_type_flag tmp_flag = 0;
6235			u32 id;
6236
6237			if (msize != size || off != moff) {
6238				bpf_log(log,
6239					"cannot access ptr member %s with moff %u in struct %s with off %u size %u\n",
6240					mname, moff, tname, off, size);
6241				return -EACCES;
6242			}
6243
6244			/* check type tag */
6245			t = btf_type_by_id(btf, mtype->type);
6246			if (btf_type_is_type_tag(t)) {
6247				tag_value = __btf_name_by_offset(btf, t->name_off);
6248				/* check __user tag */
6249				if (strcmp(tag_value, "user") == 0)
6250					tmp_flag = MEM_USER;
6251				/* check __percpu tag */
6252				if (strcmp(tag_value, "percpu") == 0)
6253					tmp_flag = MEM_PERCPU;
6254				/* check __rcu tag */
6255				if (strcmp(tag_value, "rcu") == 0)
6256					tmp_flag = MEM_RCU;
6257			}
6258
6259			stype = btf_type_skip_modifiers(btf, mtype->type, &id);
6260			if (btf_type_is_struct(stype)) {
6261				*next_btf_id = id;
6262				*flag = tmp_flag;
 
 
6263				return WALK_PTR;
6264			}
6265		}
6266
6267		/* Allow more flexible access within an int as long as
6268		 * it is within mtrue_end.
6269		 * Since mtrue_end could be the end of an array,
6270		 * that also allows using an array of int as a scratch
6271		 * space. e.g. skb->cb[].
6272		 */
6273		if (off + size > mtrue_end) {
6274			bpf_log(log,
6275				"access beyond the end of member %s (mend:%u) in struct %s with off %u size %u\n",
6276				mname, mtrue_end, tname, off, size);
6277			return -EACCES;
6278		}
6279
6280		return WALK_SCALAR;
6281	}
6282	bpf_log(log, "struct %s doesn't have field at offset %d\n", tname, off);
6283	return -EINVAL;
6284}
6285
6286int btf_struct_access(struct bpf_verifier_log *log,
6287		      const struct bpf_reg_state *reg,
6288		      int off, int size, enum bpf_access_type atype __maybe_unused,
6289		      u32 *next_btf_id, enum bpf_type_flag *flag)
 
6290{
6291	const struct btf *btf = reg->btf;
6292	enum bpf_type_flag tmp_flag = 0;
6293	const struct btf_type *t;
6294	u32 id = reg->btf_id;
6295	int err;
6296
6297	while (type_is_alloc(reg->type)) {
6298		struct btf_struct_meta *meta;
6299		struct btf_record *rec;
6300		int i;
6301
6302		meta = btf_find_struct_meta(btf, id);
6303		if (!meta)
6304			break;
6305		rec = meta->record;
6306		for (i = 0; i < rec->cnt; i++) {
6307			struct btf_field *field = &rec->fields[i];
6308			u32 offset = field->offset;
6309			if (off < offset + btf_field_type_size(field->type) && offset < off + size) {
6310				bpf_log(log,
6311					"direct access to %s is disallowed\n",
6312					btf_field_type_name(field->type));
6313				return -EACCES;
6314			}
6315		}
6316		break;
6317	}
6318
6319	t = btf_type_by_id(btf, id);
6320	do {
6321		err = btf_struct_walk(log, btf, t, off, size, &id, &tmp_flag);
6322
6323		switch (err) {
6324		case WALK_PTR:
6325			/* For local types, the destination register cannot
6326			 * become a pointer again.
6327			 */
6328			if (type_is_alloc(reg->type))
6329				return SCALAR_VALUE;
6330			/* If we found the pointer or scalar on t+off,
6331			 * we're done.
6332			 */
6333			*next_btf_id = id;
6334			*flag = tmp_flag;
6335			return PTR_TO_BTF_ID;
6336		case WALK_SCALAR:
6337			return SCALAR_VALUE;
6338		case WALK_STRUCT:
6339			/* We found nested struct, so continue the search
6340			 * by diving in it. At this point the offset is
6341			 * aligned with the new type, so set it to 0.
6342			 */
6343			t = btf_type_by_id(btf, id);
6344			off = 0;
6345			break;
6346		default:
6347			/* It's either error or unknown return value..
6348			 * scream and leave.
6349			 */
6350			if (WARN_ONCE(err > 0, "unknown btf_struct_walk return value"))
6351				return -EINVAL;
6352			return err;
6353		}
6354	} while (t);
6355
6356	return -EINVAL;
6357}
6358
6359/* Check that two BTF types, each specified as an BTF object + id, are exactly
6360 * the same. Trivial ID check is not enough due to module BTFs, because we can
6361 * end up with two different module BTFs, but IDs point to the common type in
6362 * vmlinux BTF.
6363 */
6364bool btf_types_are_same(const struct btf *btf1, u32 id1,
6365			const struct btf *btf2, u32 id2)
6366{
6367	if (id1 != id2)
6368		return false;
6369	if (btf1 == btf2)
6370		return true;
6371	return btf_type_by_id(btf1, id1) == btf_type_by_id(btf2, id2);
6372}
6373
6374bool btf_struct_ids_match(struct bpf_verifier_log *log,
6375			  const struct btf *btf, u32 id, int off,
6376			  const struct btf *need_btf, u32 need_type_id,
6377			  bool strict)
6378{
6379	const struct btf_type *type;
6380	enum bpf_type_flag flag;
6381	int err;
6382
6383	/* Are we already done? */
6384	if (off == 0 && btf_types_are_same(btf, id, need_btf, need_type_id))
6385		return true;
6386	/* In case of strict type match, we do not walk struct, the top level
6387	 * type match must succeed. When strict is true, off should have already
6388	 * been 0.
6389	 */
6390	if (strict)
6391		return false;
6392again:
6393	type = btf_type_by_id(btf, id);
6394	if (!type)
6395		return false;
6396	err = btf_struct_walk(log, btf, type, off, 1, &id, &flag);
6397	if (err != WALK_STRUCT)
6398		return false;
6399
6400	/* We found nested struct object. If it matches
6401	 * the requested ID, we're done. Otherwise let's
6402	 * continue the search with offset 0 in the new
6403	 * type.
6404	 */
6405	if (!btf_types_are_same(btf, id, need_btf, need_type_id)) {
6406		off = 0;
6407		goto again;
6408	}
6409
6410	return true;
6411}
6412
6413static int __get_type_size(struct btf *btf, u32 btf_id,
6414			   const struct btf_type **ret_type)
6415{
6416	const struct btf_type *t;
6417
6418	*ret_type = btf_type_by_id(btf, 0);
6419	if (!btf_id)
6420		/* void */
6421		return 0;
6422	t = btf_type_by_id(btf, btf_id);
6423	while (t && btf_type_is_modifier(t))
6424		t = btf_type_by_id(btf, t->type);
6425	if (!t)
6426		return -EINVAL;
6427	*ret_type = t;
6428	if (btf_type_is_ptr(t))
6429		/* kernel size of pointer. Not BPF's size of pointer*/
6430		return sizeof(void *);
6431	if (btf_type_is_int(t) || btf_is_any_enum(t) || __btf_type_is_struct(t))
6432		return t->size;
6433	return -EINVAL;
6434}
6435
 
 
 
 
 
 
 
 
 
 
 
 
6436int btf_distill_func_proto(struct bpf_verifier_log *log,
6437			   struct btf *btf,
6438			   const struct btf_type *func,
6439			   const char *tname,
6440			   struct btf_func_model *m)
6441{
6442	const struct btf_param *args;
6443	const struct btf_type *t;
6444	u32 i, nargs;
6445	int ret;
6446
6447	if (!func) {
6448		/* BTF function prototype doesn't match the verifier types.
6449		 * Fall back to MAX_BPF_FUNC_REG_ARGS u64 args.
6450		 */
6451		for (i = 0; i < MAX_BPF_FUNC_REG_ARGS; i++) {
6452			m->arg_size[i] = 8;
6453			m->arg_flags[i] = 0;
6454		}
6455		m->ret_size = 8;
 
6456		m->nr_args = MAX_BPF_FUNC_REG_ARGS;
6457		return 0;
6458	}
6459	args = (const struct btf_param *)(func + 1);
6460	nargs = btf_type_vlen(func);
6461	if (nargs > MAX_BPF_FUNC_ARGS) {
6462		bpf_log(log,
6463			"The function %s has %d arguments. Too many.\n",
6464			tname, nargs);
6465		return -EINVAL;
6466	}
6467	ret = __get_type_size(btf, func->type, &t);
6468	if (ret < 0 || __btf_type_is_struct(t)) {
6469		bpf_log(log,
6470			"The function %s return type %s is unsupported.\n",
6471			tname, btf_type_str(t));
6472		return -EINVAL;
6473	}
6474	m->ret_size = ret;
 
6475
6476	for (i = 0; i < nargs; i++) {
6477		if (i == nargs - 1 && args[i].type == 0) {
6478			bpf_log(log,
6479				"The function %s with variable args is unsupported.\n",
6480				tname);
6481			return -EINVAL;
6482		}
6483		ret = __get_type_size(btf, args[i].type, &t);
6484
6485		/* No support of struct argument size greater than 16 bytes */
6486		if (ret < 0 || ret > 16) {
6487			bpf_log(log,
6488				"The function %s arg%d type %s is unsupported.\n",
6489				tname, i, btf_type_str(t));
6490			return -EINVAL;
6491		}
6492		if (ret == 0) {
6493			bpf_log(log,
6494				"The function %s has malformed void argument.\n",
6495				tname);
6496			return -EINVAL;
6497		}
6498		m->arg_size[i] = ret;
6499		m->arg_flags[i] = __btf_type_is_struct(t) ? BTF_FMODEL_STRUCT_ARG : 0;
6500	}
6501	m->nr_args = nargs;
6502	return 0;
6503}
6504
6505/* Compare BTFs of two functions assuming only scalars and pointers to context.
6506 * t1 points to BTF_KIND_FUNC in btf1
6507 * t2 points to BTF_KIND_FUNC in btf2
6508 * Returns:
6509 * EINVAL - function prototype mismatch
6510 * EFAULT - verifier bug
6511 * 0 - 99% match. The last 1% is validated by the verifier.
6512 */
6513static int btf_check_func_type_match(struct bpf_verifier_log *log,
6514				     struct btf *btf1, const struct btf_type *t1,
6515				     struct btf *btf2, const struct btf_type *t2)
6516{
6517	const struct btf_param *args1, *args2;
6518	const char *fn1, *fn2, *s1, *s2;
6519	u32 nargs1, nargs2, i;
6520
6521	fn1 = btf_name_by_offset(btf1, t1->name_off);
6522	fn2 = btf_name_by_offset(btf2, t2->name_off);
6523
6524	if (btf_func_linkage(t1) != BTF_FUNC_GLOBAL) {
6525		bpf_log(log, "%s() is not a global function\n", fn1);
6526		return -EINVAL;
6527	}
6528	if (btf_func_linkage(t2) != BTF_FUNC_GLOBAL) {
6529		bpf_log(log, "%s() is not a global function\n", fn2);
6530		return -EINVAL;
6531	}
6532
6533	t1 = btf_type_by_id(btf1, t1->type);
6534	if (!t1 || !btf_type_is_func_proto(t1))
6535		return -EFAULT;
6536	t2 = btf_type_by_id(btf2, t2->type);
6537	if (!t2 || !btf_type_is_func_proto(t2))
6538		return -EFAULT;
6539
6540	args1 = (const struct btf_param *)(t1 + 1);
6541	nargs1 = btf_type_vlen(t1);
6542	args2 = (const struct btf_param *)(t2 + 1);
6543	nargs2 = btf_type_vlen(t2);
6544
6545	if (nargs1 != nargs2) {
6546		bpf_log(log, "%s() has %d args while %s() has %d args\n",
6547			fn1, nargs1, fn2, nargs2);
6548		return -EINVAL;
6549	}
6550
6551	t1 = btf_type_skip_modifiers(btf1, t1->type, NULL);
6552	t2 = btf_type_skip_modifiers(btf2, t2->type, NULL);
6553	if (t1->info != t2->info) {
6554		bpf_log(log,
6555			"Return type %s of %s() doesn't match type %s of %s()\n",
6556			btf_type_str(t1), fn1,
6557			btf_type_str(t2), fn2);
6558		return -EINVAL;
6559	}
6560
6561	for (i = 0; i < nargs1; i++) {
6562		t1 = btf_type_skip_modifiers(btf1, args1[i].type, NULL);
6563		t2 = btf_type_skip_modifiers(btf2, args2[i].type, NULL);
6564
6565		if (t1->info != t2->info) {
6566			bpf_log(log, "arg%d in %s() is %s while %s() has %s\n",
6567				i, fn1, btf_type_str(t1),
6568				fn2, btf_type_str(t2));
6569			return -EINVAL;
6570		}
6571		if (btf_type_has_size(t1) && t1->size != t2->size) {
6572			bpf_log(log,
6573				"arg%d in %s() has size %d while %s() has %d\n",
6574				i, fn1, t1->size,
6575				fn2, t2->size);
6576			return -EINVAL;
6577		}
6578
6579		/* global functions are validated with scalars and pointers
6580		 * to context only. And only global functions can be replaced.
6581		 * Hence type check only those types.
6582		 */
6583		if (btf_type_is_int(t1) || btf_is_any_enum(t1))
6584			continue;
6585		if (!btf_type_is_ptr(t1)) {
6586			bpf_log(log,
6587				"arg%d in %s() has unrecognized type\n",
6588				i, fn1);
6589			return -EINVAL;
6590		}
6591		t1 = btf_type_skip_modifiers(btf1, t1->type, NULL);
6592		t2 = btf_type_skip_modifiers(btf2, t2->type, NULL);
6593		if (!btf_type_is_struct(t1)) {
6594			bpf_log(log,
6595				"arg%d in %s() is not a pointer to context\n",
6596				i, fn1);
6597			return -EINVAL;
6598		}
6599		if (!btf_type_is_struct(t2)) {
6600			bpf_log(log,
6601				"arg%d in %s() is not a pointer to context\n",
6602				i, fn2);
6603			return -EINVAL;
6604		}
6605		/* This is an optional check to make program writing easier.
6606		 * Compare names of structs and report an error to the user.
6607		 * btf_prepare_func_args() already checked that t2 struct
6608		 * is a context type. btf_prepare_func_args() will check
6609		 * later that t1 struct is a context type as well.
6610		 */
6611		s1 = btf_name_by_offset(btf1, t1->name_off);
6612		s2 = btf_name_by_offset(btf2, t2->name_off);
6613		if (strcmp(s1, s2)) {
6614			bpf_log(log,
6615				"arg%d %s(struct %s *) doesn't match %s(struct %s *)\n",
6616				i, fn1, s1, fn2, s2);
6617			return -EINVAL;
6618		}
6619	}
6620	return 0;
6621}
6622
6623/* Compare BTFs of given program with BTF of target program */
6624int btf_check_type_match(struct bpf_verifier_log *log, const struct bpf_prog *prog,
6625			 struct btf *btf2, const struct btf_type *t2)
6626{
6627	struct btf *btf1 = prog->aux->btf;
6628	const struct btf_type *t1;
6629	u32 btf_id = 0;
6630
6631	if (!prog->aux->func_info) {
6632		bpf_log(log, "Program extension requires BTF\n");
6633		return -EINVAL;
6634	}
6635
6636	btf_id = prog->aux->func_info[0].type_id;
6637	if (!btf_id)
6638		return -EFAULT;
6639
6640	t1 = btf_type_by_id(btf1, btf_id);
6641	if (!t1 || !btf_type_is_func(t1))
6642		return -EFAULT;
6643
6644	return btf_check_func_type_match(log, btf1, t1, btf2, t2);
6645}
6646
6647static int btf_check_func_arg_match(struct bpf_verifier_env *env,
6648				    const struct btf *btf, u32 func_id,
6649				    struct bpf_reg_state *regs,
6650				    bool ptr_to_mem_ok,
6651				    bool processing_call)
6652{
6653	enum bpf_prog_type prog_type = resolve_prog_type(env->prog);
6654	struct bpf_verifier_log *log = &env->log;
6655	const char *func_name, *ref_tname;
6656	const struct btf_type *t, *ref_t;
6657	const struct btf_param *args;
6658	u32 i, nargs, ref_id;
6659	int ret;
6660
6661	t = btf_type_by_id(btf, func_id);
6662	if (!t || !btf_type_is_func(t)) {
6663		/* These checks were already done by the verifier while loading
6664		 * struct bpf_func_info or in add_kfunc_call().
6665		 */
6666		bpf_log(log, "BTF of func_id %u doesn't point to KIND_FUNC\n",
6667			func_id);
6668		return -EFAULT;
6669	}
6670	func_name = btf_name_by_offset(btf, t->name_off);
6671
6672	t = btf_type_by_id(btf, t->type);
6673	if (!t || !btf_type_is_func_proto(t)) {
6674		bpf_log(log, "Invalid BTF of func %s\n", func_name);
6675		return -EFAULT;
6676	}
6677	args = (const struct btf_param *)(t + 1);
6678	nargs = btf_type_vlen(t);
6679	if (nargs > MAX_BPF_FUNC_REG_ARGS) {
6680		bpf_log(log, "Function %s has %d > %d args\n", func_name, nargs,
6681			MAX_BPF_FUNC_REG_ARGS);
6682		return -EINVAL;
6683	}
6684
6685	/* check that BTF function arguments match actual types that the
6686	 * verifier sees.
6687	 */
6688	for (i = 0; i < nargs; i++) {
6689		enum bpf_arg_type arg_type = ARG_DONTCARE;
6690		u32 regno = i + 1;
6691		struct bpf_reg_state *reg = &regs[regno];
6692
6693		t = btf_type_skip_modifiers(btf, args[i].type, NULL);
6694		if (btf_type_is_scalar(t)) {
6695			if (reg->type == SCALAR_VALUE)
6696				continue;
6697			bpf_log(log, "R%d is not a scalar\n", regno);
6698			return -EINVAL;
6699		}
6700
6701		if (!btf_type_is_ptr(t)) {
6702			bpf_log(log, "Unrecognized arg#%d type %s\n",
6703				i, btf_type_str(t));
6704			return -EINVAL;
6705		}
6706
6707		ref_t = btf_type_skip_modifiers(btf, t->type, &ref_id);
6708		ref_tname = btf_name_by_offset(btf, ref_t->name_off);
6709
6710		ret = check_func_arg_reg_off(env, reg, regno, arg_type);
6711		if (ret < 0)
6712			return ret;
6713
6714		if (btf_get_prog_ctx_type(log, btf, t, prog_type, i)) {
6715			/* If function expects ctx type in BTF check that caller
6716			 * is passing PTR_TO_CTX.
6717			 */
6718			if (reg->type != PTR_TO_CTX) {
6719				bpf_log(log,
6720					"arg#%d expected pointer to ctx, but got %s\n",
6721					i, btf_type_str(t));
6722				return -EINVAL;
6723			}
6724		} else if (ptr_to_mem_ok && processing_call) {
6725			const struct btf_type *resolve_ret;
6726			u32 type_size;
6727
6728			resolve_ret = btf_resolve_size(btf, ref_t, &type_size);
6729			if (IS_ERR(resolve_ret)) {
6730				bpf_log(log,
6731					"arg#%d reference type('%s %s') size cannot be determined: %ld\n",
6732					i, btf_type_str(ref_t), ref_tname,
6733					PTR_ERR(resolve_ret));
6734				return -EINVAL;
6735			}
6736
6737			if (check_mem_reg(env, reg, regno, type_size))
6738				return -EINVAL;
6739		} else {
6740			bpf_log(log, "reg type unsupported for arg#%d function %s#%d\n", i,
6741				func_name, func_id);
6742			return -EINVAL;
6743		}
6744	}
6745
6746	return 0;
6747}
6748
6749/* Compare BTF of a function declaration with given bpf_reg_state.
6750 * Returns:
6751 * EFAULT - there is a verifier bug. Abort verification.
6752 * EINVAL - there is a type mismatch or BTF is not available.
6753 * 0 - BTF matches with what bpf_reg_state expects.
6754 * Only PTR_TO_CTX and SCALAR_VALUE states are recognized.
6755 */
6756int btf_check_subprog_arg_match(struct bpf_verifier_env *env, int subprog,
6757				struct bpf_reg_state *regs)
6758{
6759	struct bpf_prog *prog = env->prog;
6760	struct btf *btf = prog->aux->btf;
6761	bool is_global;
6762	u32 btf_id;
6763	int err;
6764
6765	if (!prog->aux->func_info)
6766		return -EINVAL;
6767
6768	btf_id = prog->aux->func_info[subprog].type_id;
6769	if (!btf_id)
6770		return -EFAULT;
6771
6772	if (prog->aux->func_info_aux[subprog].unreliable)
6773		return -EINVAL;
6774
6775	is_global = prog->aux->func_info_aux[subprog].linkage == BTF_FUNC_GLOBAL;
6776	err = btf_check_func_arg_match(env, btf, btf_id, regs, is_global, false);
6777
6778	/* Compiler optimizations can remove arguments from static functions
6779	 * or mismatched type can be passed into a global function.
6780	 * In such cases mark the function as unreliable from BTF point of view.
6781	 */
6782	if (err)
6783		prog->aux->func_info_aux[subprog].unreliable = true;
6784	return err;
6785}
6786
6787/* Compare BTF of a function call with given bpf_reg_state.
6788 * Returns:
6789 * EFAULT - there is a verifier bug. Abort verification.
6790 * EINVAL - there is a type mismatch or BTF is not available.
6791 * 0 - BTF matches with what bpf_reg_state expects.
6792 * Only PTR_TO_CTX and SCALAR_VALUE states are recognized.
6793 *
6794 * NOTE: the code is duplicated from btf_check_subprog_arg_match()
6795 * because btf_check_func_arg_match() is still doing both. Once that
6796 * function is split in 2, we can call from here btf_check_subprog_arg_match()
6797 * first, and then treat the calling part in a new code path.
6798 */
6799int btf_check_subprog_call(struct bpf_verifier_env *env, int subprog,
6800			   struct bpf_reg_state *regs)
6801{
6802	struct bpf_prog *prog = env->prog;
6803	struct btf *btf = prog->aux->btf;
6804	bool is_global;
6805	u32 btf_id;
6806	int err;
6807
6808	if (!prog->aux->func_info)
6809		return -EINVAL;
6810
6811	btf_id = prog->aux->func_info[subprog].type_id;
6812	if (!btf_id)
6813		return -EFAULT;
6814
6815	if (prog->aux->func_info_aux[subprog].unreliable)
6816		return -EINVAL;
 
 
 
 
 
6817
6818	is_global = prog->aux->func_info_aux[subprog].linkage == BTF_FUNC_GLOBAL;
6819	err = btf_check_func_arg_match(env, btf, btf_id, regs, is_global, true);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
6820
6821	/* Compiler optimizations can remove arguments from static functions
6822	 * or mismatched type can be passed into a global function.
6823	 * In such cases mark the function as unreliable from BTF point of view.
6824	 */
6825	if (err)
6826		prog->aux->func_info_aux[subprog].unreliable = true;
6827	return err;
 
6828}
6829
6830/* Convert BTF of a function into bpf_reg_state if possible
 
 
 
 
 
 
 
 
 
 
6831 * Returns:
6832 * EFAULT - there is a verifier bug. Abort verification.
6833 * EINVAL - cannot convert BTF.
6834 * 0 - Successfully converted BTF into bpf_reg_state
6835 * (either PTR_TO_CTX or SCALAR_VALUE).
6836 */
6837int btf_prepare_func_args(struct bpf_verifier_env *env, int subprog,
6838			  struct bpf_reg_state *regs)
6839{
 
 
6840	struct bpf_verifier_log *log = &env->log;
6841	struct bpf_prog *prog = env->prog;
6842	enum bpf_prog_type prog_type = prog->type;
6843	struct btf *btf = prog->aux->btf;
6844	const struct btf_param *args;
6845	const struct btf_type *t, *ref_t;
6846	u32 i, nargs, btf_id;
6847	const char *tname;
6848
6849	if (!prog->aux->func_info ||
6850	    prog->aux->func_info_aux[subprog].linkage != BTF_FUNC_GLOBAL) {
 
 
6851		bpf_log(log, "Verifier bug\n");
6852		return -EFAULT;
6853	}
6854
6855	btf_id = prog->aux->func_info[subprog].type_id;
6856	if (!btf_id) {
 
 
6857		bpf_log(log, "Global functions need valid BTF\n");
6858		return -EFAULT;
6859	}
6860
6861	t = btf_type_by_id(btf, btf_id);
6862	if (!t || !btf_type_is_func(t)) {
6863		/* These checks were already done by the verifier while loading
6864		 * struct bpf_func_info
6865		 */
6866		bpf_log(log, "BTF of func#%d doesn't point to KIND_FUNC\n",
6867			subprog);
6868		return -EFAULT;
6869	}
6870	tname = btf_name_by_offset(btf, t->name_off);
6871
6872	if (log->level & BPF_LOG_LEVEL)
6873		bpf_log(log, "Validating %s() func#%d...\n",
6874			tname, subprog);
6875
6876	if (prog->aux->func_info_aux[subprog].unreliable) {
6877		bpf_log(log, "Verifier bug in function %s()\n", tname);
6878		return -EFAULT;
6879	}
6880	if (prog_type == BPF_PROG_TYPE_EXT)
6881		prog_type = prog->aux->dst_prog->type;
6882
6883	t = btf_type_by_id(btf, t->type);
6884	if (!t || !btf_type_is_func_proto(t)) {
6885		bpf_log(log, "Invalid type of function %s()\n", tname);
6886		return -EFAULT;
6887	}
6888	args = (const struct btf_param *)(t + 1);
6889	nargs = btf_type_vlen(t);
6890	if (nargs > MAX_BPF_FUNC_REG_ARGS) {
 
 
6891		bpf_log(log, "Global function %s() with %d > %d args. Buggy compiler.\n",
6892			tname, nargs, MAX_BPF_FUNC_REG_ARGS);
6893		return -EINVAL;
6894	}
6895	/* check that function returns int */
6896	t = btf_type_by_id(btf, t->type);
6897	while (btf_type_is_modifier(t))
6898		t = btf_type_by_id(btf, t->type);
6899	if (!btf_type_is_int(t) && !btf_is_any_enum(t)) {
 
 
6900		bpf_log(log,
6901			"Global function %s() doesn't return scalar. Only those are supported.\n",
6902			tname);
6903		return -EINVAL;
6904	}
6905	/* Convert BTF function arguments into verifier types.
6906	 * Only PTR_TO_CTX and SCALAR are supported atm.
6907	 */
6908	for (i = 0; i < nargs; i++) {
6909		struct bpf_reg_state *reg = &regs[i + 1];
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
6910
6911		t = btf_type_by_id(btf, args[i].type);
6912		while (btf_type_is_modifier(t))
6913			t = btf_type_by_id(btf, t->type);
6914		if (btf_type_is_int(t) || btf_is_any_enum(t)) {
6915			reg->type = SCALAR_VALUE;
 
 
 
 
 
 
 
 
 
 
 
6916			continue;
6917		}
6918		if (btf_type_is_ptr(t)) {
6919			if (btf_get_prog_ctx_type(log, btf, t, prog_type, i)) {
6920				reg->type = PTR_TO_CTX;
6921				continue;
6922			}
 
 
 
 
 
6923
6924			t = btf_type_skip_modifiers(btf, t->type, NULL);
 
 
 
6925
6926			ref_t = btf_resolve_size(btf, t, &reg->mem_size);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
6927			if (IS_ERR(ref_t)) {
6928				bpf_log(log,
6929				    "arg#%d reference type('%s %s') size cannot be determined: %ld\n",
6930				    i, btf_type_str(t), btf_name_by_offset(btf, t->name_off),
6931					PTR_ERR(ref_t));
6932				return -EINVAL;
6933			}
6934
6935			reg->type = PTR_TO_MEM | PTR_MAYBE_NULL;
6936			reg->id = ++env->id_gen;
 
 
 
 
6937
 
 
 
 
 
 
 
6938			continue;
6939		}
 
 
6940		bpf_log(log, "Arg#%d type %s in %s() is not supported yet.\n",
6941			i, btf_type_str(t), tname);
6942		return -EINVAL;
6943	}
 
 
 
 
6944	return 0;
6945}
6946
6947static void btf_type_show(const struct btf *btf, u32 type_id, void *obj,
6948			  struct btf_show *show)
6949{
6950	const struct btf_type *t = btf_type_by_id(btf, type_id);
6951
6952	show->btf = btf;
6953	memset(&show->state, 0, sizeof(show->state));
6954	memset(&show->obj, 0, sizeof(show->obj));
6955
6956	btf_type_ops(t)->show(btf, t, type_id, obj, 0, show);
6957}
6958
6959static void btf_seq_show(struct btf_show *show, const char *fmt,
6960			 va_list args)
6961{
6962	seq_vprintf((struct seq_file *)show->target, fmt, args);
6963}
6964
6965int btf_type_seq_show_flags(const struct btf *btf, u32 type_id,
6966			    void *obj, struct seq_file *m, u64 flags)
6967{
6968	struct btf_show sseq;
6969
6970	sseq.target = m;
6971	sseq.showfn = btf_seq_show;
6972	sseq.flags = flags;
6973
6974	btf_type_show(btf, type_id, obj, &sseq);
6975
6976	return sseq.state.status;
6977}
6978
6979void btf_type_seq_show(const struct btf *btf, u32 type_id, void *obj,
6980		       struct seq_file *m)
6981{
6982	(void) btf_type_seq_show_flags(btf, type_id, obj, m,
6983				       BTF_SHOW_NONAME | BTF_SHOW_COMPACT |
6984				       BTF_SHOW_ZERO | BTF_SHOW_UNSAFE);
6985}
6986
6987struct btf_show_snprintf {
6988	struct btf_show show;
6989	int len_left;		/* space left in string */
6990	int len;		/* length we would have written */
6991};
6992
6993static void btf_snprintf_show(struct btf_show *show, const char *fmt,
6994			      va_list args)
6995{
6996	struct btf_show_snprintf *ssnprintf = (struct btf_show_snprintf *)show;
6997	int len;
6998
6999	len = vsnprintf(show->target, ssnprintf->len_left, fmt, args);
7000
7001	if (len < 0) {
7002		ssnprintf->len_left = 0;
7003		ssnprintf->len = len;
7004	} else if (len >= ssnprintf->len_left) {
7005		/* no space, drive on to get length we would have written */
7006		ssnprintf->len_left = 0;
7007		ssnprintf->len += len;
7008	} else {
7009		ssnprintf->len_left -= len;
7010		ssnprintf->len += len;
7011		show->target += len;
7012	}
7013}
7014
7015int btf_type_snprintf_show(const struct btf *btf, u32 type_id, void *obj,
7016			   char *buf, int len, u64 flags)
7017{
7018	struct btf_show_snprintf ssnprintf;
7019
7020	ssnprintf.show.target = buf;
7021	ssnprintf.show.flags = flags;
7022	ssnprintf.show.showfn = btf_snprintf_show;
7023	ssnprintf.len_left = len;
7024	ssnprintf.len = 0;
7025
7026	btf_type_show(btf, type_id, obj, (struct btf_show *)&ssnprintf);
7027
7028	/* If we encountered an error, return it. */
7029	if (ssnprintf.show.state.status)
7030		return ssnprintf.show.state.status;
7031
7032	/* Otherwise return length we would have written */
7033	return ssnprintf.len;
7034}
7035
7036#ifdef CONFIG_PROC_FS
7037static void bpf_btf_show_fdinfo(struct seq_file *m, struct file *filp)
7038{
7039	const struct btf *btf = filp->private_data;
7040
7041	seq_printf(m, "btf_id:\t%u\n", btf->id);
7042}
7043#endif
7044
7045static int btf_release(struct inode *inode, struct file *filp)
7046{
7047	btf_put(filp->private_data);
7048	return 0;
7049}
7050
7051const struct file_operations btf_fops = {
7052#ifdef CONFIG_PROC_FS
7053	.show_fdinfo	= bpf_btf_show_fdinfo,
7054#endif
7055	.release	= btf_release,
7056};
7057
7058static int __btf_new_fd(struct btf *btf)
7059{
7060	return anon_inode_getfd("btf", &btf_fops, btf, O_RDONLY | O_CLOEXEC);
7061}
7062
7063int btf_new_fd(const union bpf_attr *attr, bpfptr_t uattr)
7064{
7065	struct btf *btf;
7066	int ret;
7067
7068	btf = btf_parse(make_bpfptr(attr->btf, uattr.is_kernel),
7069			attr->btf_size, attr->btf_log_level,
7070			u64_to_user_ptr(attr->btf_log_buf),
7071			attr->btf_log_size);
7072	if (IS_ERR(btf))
7073		return PTR_ERR(btf);
7074
7075	ret = btf_alloc_id(btf);
7076	if (ret) {
7077		btf_free(btf);
7078		return ret;
7079	}
7080
7081	/*
7082	 * The BTF ID is published to the userspace.
7083	 * All BTF free must go through call_rcu() from
7084	 * now on (i.e. free by calling btf_put()).
7085	 */
7086
7087	ret = __btf_new_fd(btf);
7088	if (ret < 0)
7089		btf_put(btf);
7090
7091	return ret;
7092}
7093
7094struct btf *btf_get_by_fd(int fd)
7095{
7096	struct btf *btf;
7097	struct fd f;
7098
7099	f = fdget(fd);
7100
7101	if (!f.file)
7102		return ERR_PTR(-EBADF);
7103
7104	if (f.file->f_op != &btf_fops) {
7105		fdput(f);
7106		return ERR_PTR(-EINVAL);
7107	}
7108
7109	btf = f.file->private_data;
7110	refcount_inc(&btf->refcnt);
7111	fdput(f);
7112
7113	return btf;
7114}
7115
7116int btf_get_info_by_fd(const struct btf *btf,
7117		       const union bpf_attr *attr,
7118		       union bpf_attr __user *uattr)
7119{
7120	struct bpf_btf_info __user *uinfo;
7121	struct bpf_btf_info info;
7122	u32 info_copy, btf_copy;
7123	void __user *ubtf;
7124	char __user *uname;
7125	u32 uinfo_len, uname_len, name_len;
7126	int ret = 0;
7127
7128	uinfo = u64_to_user_ptr(attr->info.info);
7129	uinfo_len = attr->info.info_len;
7130
7131	info_copy = min_t(u32, uinfo_len, sizeof(info));
7132	memset(&info, 0, sizeof(info));
7133	if (copy_from_user(&info, uinfo, info_copy))
7134		return -EFAULT;
7135
7136	info.id = btf->id;
7137	ubtf = u64_to_user_ptr(info.btf);
7138	btf_copy = min_t(u32, btf->data_size, info.btf_size);
7139	if (copy_to_user(ubtf, btf->data, btf_copy))
7140		return -EFAULT;
7141	info.btf_size = btf->data_size;
7142
7143	info.kernel_btf = btf->kernel_btf;
7144
7145	uname = u64_to_user_ptr(info.name);
7146	uname_len = info.name_len;
7147	if (!uname ^ !uname_len)
7148		return -EINVAL;
7149
7150	name_len = strlen(btf->name);
7151	info.name_len = name_len;
7152
7153	if (uname) {
7154		if (uname_len >= name_len + 1) {
7155			if (copy_to_user(uname, btf->name, name_len + 1))
7156				return -EFAULT;
7157		} else {
7158			char zero = '\0';
7159
7160			if (copy_to_user(uname, btf->name, uname_len - 1))
7161				return -EFAULT;
7162			if (put_user(zero, uname + uname_len - 1))
7163				return -EFAULT;
7164			/* let user-space know about too short buffer */
7165			ret = -ENOSPC;
7166		}
7167	}
7168
7169	if (copy_to_user(uinfo, &info, info_copy) ||
7170	    put_user(info_copy, &uattr->info.info_len))
7171		return -EFAULT;
7172
7173	return ret;
7174}
7175
7176int btf_get_fd_by_id(u32 id)
7177{
7178	struct btf *btf;
7179	int fd;
7180
7181	rcu_read_lock();
7182	btf = idr_find(&btf_idr, id);
7183	if (!btf || !refcount_inc_not_zero(&btf->refcnt))
7184		btf = ERR_PTR(-ENOENT);
7185	rcu_read_unlock();
7186
7187	if (IS_ERR(btf))
7188		return PTR_ERR(btf);
7189
7190	fd = __btf_new_fd(btf);
7191	if (fd < 0)
7192		btf_put(btf);
7193
7194	return fd;
7195}
7196
7197u32 btf_obj_id(const struct btf *btf)
7198{
7199	return btf->id;
7200}
7201
7202bool btf_is_kernel(const struct btf *btf)
7203{
7204	return btf->kernel_btf;
7205}
7206
7207bool btf_is_module(const struct btf *btf)
7208{
7209	return btf->kernel_btf && strcmp(btf->name, "vmlinux") != 0;
7210}
7211
7212enum {
7213	BTF_MODULE_F_LIVE = (1 << 0),
7214};
7215
7216#ifdef CONFIG_DEBUG_INFO_BTF_MODULES
7217struct btf_module {
7218	struct list_head list;
7219	struct module *module;
7220	struct btf *btf;
7221	struct bin_attribute *sysfs_attr;
7222	int flags;
7223};
7224
7225static LIST_HEAD(btf_modules);
7226static DEFINE_MUTEX(btf_module_mutex);
7227
7228static ssize_t
7229btf_module_read(struct file *file, struct kobject *kobj,
7230		struct bin_attribute *bin_attr,
7231		char *buf, loff_t off, size_t len)
7232{
7233	const struct btf *btf = bin_attr->private;
7234
7235	memcpy(buf, btf->data + off, len);
7236	return len;
7237}
7238
7239static void purge_cand_cache(struct btf *btf);
7240
7241static int btf_module_notify(struct notifier_block *nb, unsigned long op,
7242			     void *module)
7243{
7244	struct btf_module *btf_mod, *tmp;
7245	struct module *mod = module;
7246	struct btf *btf;
7247	int err = 0;
7248
7249	if (mod->btf_data_size == 0 ||
7250	    (op != MODULE_STATE_COMING && op != MODULE_STATE_LIVE &&
7251	     op != MODULE_STATE_GOING))
7252		goto out;
7253
7254	switch (op) {
7255	case MODULE_STATE_COMING:
7256		btf_mod = kzalloc(sizeof(*btf_mod), GFP_KERNEL);
7257		if (!btf_mod) {
7258			err = -ENOMEM;
7259			goto out;
7260		}
7261		btf = btf_parse_module(mod->name, mod->btf_data, mod->btf_data_size);
 
7262		if (IS_ERR(btf)) {
7263			pr_warn("failed to validate module [%s] BTF: %ld\n",
7264				mod->name, PTR_ERR(btf));
7265			kfree(btf_mod);
7266			if (!IS_ENABLED(CONFIG_MODULE_ALLOW_BTF_MISMATCH))
 
 
7267				err = PTR_ERR(btf);
 
 
 
7268			goto out;
7269		}
7270		err = btf_alloc_id(btf);
7271		if (err) {
7272			btf_free(btf);
7273			kfree(btf_mod);
7274			goto out;
7275		}
7276
7277		purge_cand_cache(NULL);
7278		mutex_lock(&btf_module_mutex);
7279		btf_mod->module = module;
7280		btf_mod->btf = btf;
7281		list_add(&btf_mod->list, &btf_modules);
7282		mutex_unlock(&btf_module_mutex);
7283
7284		if (IS_ENABLED(CONFIG_SYSFS)) {
7285			struct bin_attribute *attr;
7286
7287			attr = kzalloc(sizeof(*attr), GFP_KERNEL);
7288			if (!attr)
7289				goto out;
7290
7291			sysfs_bin_attr_init(attr);
7292			attr->attr.name = btf->name;
7293			attr->attr.mode = 0444;
7294			attr->size = btf->data_size;
7295			attr->private = btf;
7296			attr->read = btf_module_read;
7297
7298			err = sysfs_create_bin_file(btf_kobj, attr);
7299			if (err) {
7300				pr_warn("failed to register module [%s] BTF in sysfs: %d\n",
7301					mod->name, err);
7302				kfree(attr);
7303				err = 0;
7304				goto out;
7305			}
7306
7307			btf_mod->sysfs_attr = attr;
7308		}
7309
7310		break;
7311	case MODULE_STATE_LIVE:
7312		mutex_lock(&btf_module_mutex);
7313		list_for_each_entry_safe(btf_mod, tmp, &btf_modules, list) {
7314			if (btf_mod->module != module)
7315				continue;
7316
7317			btf_mod->flags |= BTF_MODULE_F_LIVE;
7318			break;
7319		}
7320		mutex_unlock(&btf_module_mutex);
7321		break;
7322	case MODULE_STATE_GOING:
7323		mutex_lock(&btf_module_mutex);
7324		list_for_each_entry_safe(btf_mod, tmp, &btf_modules, list) {
7325			if (btf_mod->module != module)
7326				continue;
7327
7328			list_del(&btf_mod->list);
7329			if (btf_mod->sysfs_attr)
7330				sysfs_remove_bin_file(btf_kobj, btf_mod->sysfs_attr);
7331			purge_cand_cache(btf_mod->btf);
7332			btf_put(btf_mod->btf);
7333			kfree(btf_mod->sysfs_attr);
7334			kfree(btf_mod);
7335			break;
7336		}
7337		mutex_unlock(&btf_module_mutex);
7338		break;
7339	}
7340out:
7341	return notifier_from_errno(err);
7342}
7343
7344static struct notifier_block btf_module_nb = {
7345	.notifier_call = btf_module_notify,
7346};
7347
7348static int __init btf_module_init(void)
7349{
7350	register_module_notifier(&btf_module_nb);
7351	return 0;
7352}
7353
7354fs_initcall(btf_module_init);
7355#endif /* CONFIG_DEBUG_INFO_BTF_MODULES */
7356
7357struct module *btf_try_get_module(const struct btf *btf)
7358{
7359	struct module *res = NULL;
7360#ifdef CONFIG_DEBUG_INFO_BTF_MODULES
7361	struct btf_module *btf_mod, *tmp;
7362
7363	mutex_lock(&btf_module_mutex);
7364	list_for_each_entry_safe(btf_mod, tmp, &btf_modules, list) {
7365		if (btf_mod->btf != btf)
7366			continue;
7367
7368		/* We must only consider module whose __init routine has
7369		 * finished, hence we must check for BTF_MODULE_F_LIVE flag,
7370		 * which is set from the notifier callback for
7371		 * MODULE_STATE_LIVE.
7372		 */
7373		if ((btf_mod->flags & BTF_MODULE_F_LIVE) && try_module_get(btf_mod->module))
7374			res = btf_mod->module;
7375
7376		break;
7377	}
7378	mutex_unlock(&btf_module_mutex);
7379#endif
7380
7381	return res;
7382}
7383
7384/* Returns struct btf corresponding to the struct module.
7385 * This function can return NULL or ERR_PTR.
7386 */
7387static struct btf *btf_get_module_btf(const struct module *module)
7388{
7389#ifdef CONFIG_DEBUG_INFO_BTF_MODULES
7390	struct btf_module *btf_mod, *tmp;
7391#endif
7392	struct btf *btf = NULL;
7393
7394	if (!module) {
7395		btf = bpf_get_btf_vmlinux();
7396		if (!IS_ERR_OR_NULL(btf))
7397			btf_get(btf);
7398		return btf;
7399	}
7400
7401#ifdef CONFIG_DEBUG_INFO_BTF_MODULES
7402	mutex_lock(&btf_module_mutex);
7403	list_for_each_entry_safe(btf_mod, tmp, &btf_modules, list) {
7404		if (btf_mod->module != module)
7405			continue;
7406
7407		btf_get(btf_mod->btf);
7408		btf = btf_mod->btf;
7409		break;
7410	}
7411	mutex_unlock(&btf_module_mutex);
7412#endif
7413
7414	return btf;
7415}
7416
 
 
 
 
 
 
 
 
 
 
 
7417BPF_CALL_4(bpf_btf_find_by_name_kind, char *, name, int, name_sz, u32, kind, int, flags)
7418{
7419	struct btf *btf = NULL;
7420	int btf_obj_fd = 0;
7421	long ret;
7422
7423	if (flags)
7424		return -EINVAL;
7425
7426	if (name_sz <= 1 || name[name_sz - 1])
7427		return -EINVAL;
7428
7429	ret = bpf_find_btf_id(name, kind, &btf);
7430	if (ret > 0 && btf_is_module(btf)) {
7431		btf_obj_fd = __btf_new_fd(btf);
7432		if (btf_obj_fd < 0) {
7433			btf_put(btf);
7434			return btf_obj_fd;
7435		}
7436		return ret | (((u64)btf_obj_fd) << 32);
7437	}
7438	if (ret > 0)
7439		btf_put(btf);
7440	return ret;
7441}
7442
7443const struct bpf_func_proto bpf_btf_find_by_name_kind_proto = {
7444	.func		= bpf_btf_find_by_name_kind,
7445	.gpl_only	= false,
7446	.ret_type	= RET_INTEGER,
7447	.arg1_type	= ARG_PTR_TO_MEM | MEM_RDONLY,
7448	.arg2_type	= ARG_CONST_SIZE,
7449	.arg3_type	= ARG_ANYTHING,
7450	.arg4_type	= ARG_ANYTHING,
7451};
7452
7453BTF_ID_LIST_GLOBAL(btf_tracing_ids, MAX_BTF_TRACING_TYPE)
7454#define BTF_TRACING_TYPE(name, type) BTF_ID(struct, type)
7455BTF_TRACING_TYPE_xxx
7456#undef BTF_TRACING_TYPE
7457
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
7458/* Kernel Function (kfunc) BTF ID set registration API */
7459
7460static int btf_populate_kfunc_set(struct btf *btf, enum btf_kfunc_hook hook,
7461				  struct btf_id_set8 *add_set)
7462{
 
 
7463	bool vmlinux_set = !btf_is_module(btf);
 
7464	struct btf_kfunc_set_tab *tab;
7465	struct btf_id_set8 *set;
7466	u32 set_cnt;
7467	int ret;
7468
7469	if (hook >= BTF_KFUNC_HOOK_MAX) {
7470		ret = -EINVAL;
7471		goto end;
7472	}
7473
7474	if (!add_set->cnt)
7475		return 0;
7476
7477	tab = btf->kfunc_set_tab;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
7478	if (!tab) {
7479		tab = kzalloc(sizeof(*tab), GFP_KERNEL | __GFP_NOWARN);
7480		if (!tab)
7481			return -ENOMEM;
7482		btf->kfunc_set_tab = tab;
7483	}
7484
7485	set = tab->sets[hook];
7486	/* Warn when register_btf_kfunc_id_set is called twice for the same hook
7487	 * for module sets.
7488	 */
7489	if (WARN_ON_ONCE(set && !vmlinux_set)) {
7490		ret = -EINVAL;
7491		goto end;
7492	}
7493
7494	/* We don't need to allocate, concatenate, and sort module sets, because
7495	 * only one is allowed per hook. Hence, we can directly assign the
7496	 * pointer and return.
7497	 */
7498	if (!vmlinux_set) {
7499		tab->sets[hook] = add_set;
7500		return 0;
7501	}
7502
7503	/* In case of vmlinux sets, there may be more than one set being
7504	 * registered per hook. To create a unified set, we allocate a new set
7505	 * and concatenate all individual sets being registered. While each set
7506	 * is individually sorted, they may become unsorted when concatenated,
7507	 * hence re-sorting the final set again is required to make binary
7508	 * searching the set using btf_id_set8_contains function work.
 
 
 
7509	 */
7510	set_cnt = set ? set->cnt : 0;
7511
7512	if (set_cnt > U32_MAX - add_set->cnt) {
7513		ret = -EOVERFLOW;
7514		goto end;
7515	}
7516
7517	if (set_cnt + add_set->cnt > BTF_KFUNC_SET_MAX_CNT) {
7518		ret = -E2BIG;
7519		goto end;
7520	}
7521
7522	/* Grow set */
7523	set = krealloc(tab->sets[hook],
7524		       offsetof(struct btf_id_set8, pairs[set_cnt + add_set->cnt]),
7525		       GFP_KERNEL | __GFP_NOWARN);
7526	if (!set) {
7527		ret = -ENOMEM;
7528		goto end;
7529	}
7530
7531	/* For newly allocated set, initialize set->cnt to 0 */
7532	if (!tab->sets[hook])
7533		set->cnt = 0;
7534	tab->sets[hook] = set;
7535
7536	/* Concatenate the two sets */
7537	memcpy(set->pairs + set->cnt, add_set->pairs, add_set->cnt * sizeof(set->pairs[0]));
 
 
 
 
7538	set->cnt += add_set->cnt;
7539
7540	sort(set->pairs, set->cnt, sizeof(set->pairs[0]), btf_id_cmp_func, NULL);
7541
 
 
 
 
7542	return 0;
7543end:
7544	btf_free_kfunc_set_tab(btf);
7545	return ret;
7546}
7547
7548static u32 *__btf_kfunc_id_set_contains(const struct btf *btf,
7549					enum btf_kfunc_hook hook,
7550					u32 kfunc_btf_id)
 
7551{
 
7552	struct btf_id_set8 *set;
7553	u32 *id;
7554
7555	if (hook >= BTF_KFUNC_HOOK_MAX)
7556		return NULL;
7557	if (!btf->kfunc_set_tab)
7558		return NULL;
 
 
 
 
 
7559	set = btf->kfunc_set_tab->sets[hook];
7560	if (!set)
7561		return NULL;
7562	id = btf_id_set8_contains(set, kfunc_btf_id);
7563	if (!id)
7564		return NULL;
7565	/* The flags for BTF ID are located next to it */
7566	return id + 1;
7567}
7568
7569static int bpf_prog_type_to_kfunc_hook(enum bpf_prog_type prog_type)
7570{
7571	switch (prog_type) {
7572	case BPF_PROG_TYPE_UNSPEC:
7573		return BTF_KFUNC_HOOK_COMMON;
7574	case BPF_PROG_TYPE_XDP:
7575		return BTF_KFUNC_HOOK_XDP;
7576	case BPF_PROG_TYPE_SCHED_CLS:
7577		return BTF_KFUNC_HOOK_TC;
7578	case BPF_PROG_TYPE_STRUCT_OPS:
7579		return BTF_KFUNC_HOOK_STRUCT_OPS;
7580	case BPF_PROG_TYPE_TRACING:
 
 
7581	case BPF_PROG_TYPE_LSM:
7582		return BTF_KFUNC_HOOK_TRACING;
7583	case BPF_PROG_TYPE_SYSCALL:
7584		return BTF_KFUNC_HOOK_SYSCALL;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
7585	default:
7586		return BTF_KFUNC_HOOK_MAX;
7587	}
7588}
7589
7590/* Caution:
7591 * Reference to the module (obtained using btf_try_get_module) corresponding to
7592 * the struct btf *MUST* be held when calling this function from verifier
7593 * context. This is usually true as we stash references in prog's kfunc_btf_tab;
7594 * keeping the reference for the duration of the call provides the necessary
7595 * protection for looking up a well-formed btf->kfunc_set_tab.
7596 */
7597u32 *btf_kfunc_id_set_contains(const struct btf *btf,
7598			       enum bpf_prog_type prog_type,
7599			       u32 kfunc_btf_id)
7600{
 
7601	enum btf_kfunc_hook hook;
7602	u32 *kfunc_flags;
7603
7604	kfunc_flags = __btf_kfunc_id_set_contains(btf, BTF_KFUNC_HOOK_COMMON, kfunc_btf_id);
7605	if (kfunc_flags)
7606		return kfunc_flags;
7607
7608	hook = bpf_prog_type_to_kfunc_hook(prog_type);
7609	return __btf_kfunc_id_set_contains(btf, hook, kfunc_btf_id);
7610}
7611
7612u32 *btf_kfunc_is_modify_return(const struct btf *btf, u32 kfunc_btf_id)
 
7613{
7614	return __btf_kfunc_id_set_contains(btf, BTF_KFUNC_HOOK_FMODRET, kfunc_btf_id);
7615}
7616
7617static int __register_btf_kfunc_id_set(enum btf_kfunc_hook hook,
7618				       const struct btf_kfunc_id_set *kset)
7619{
7620	struct btf *btf;
7621	int ret;
7622
7623	btf = btf_get_module_btf(kset->owner);
7624	if (!btf) {
7625		if (!kset->owner && IS_ENABLED(CONFIG_DEBUG_INFO_BTF)) {
7626			pr_err("missing vmlinux BTF, cannot register kfuncs\n");
7627			return -ENOENT;
7628		}
7629		if (kset->owner && IS_ENABLED(CONFIG_DEBUG_INFO_BTF_MODULES)) {
7630			pr_err("missing module BTF, cannot register kfuncs\n");
7631			return -ENOENT;
7632		}
7633		return 0;
7634	}
7635	if (IS_ERR(btf))
7636		return PTR_ERR(btf);
7637
7638	ret = btf_populate_kfunc_set(btf, hook, kset->set);
 
 
 
 
 
 
 
 
 
7639	btf_put(btf);
7640	return ret;
7641}
7642
7643/* This function must be invoked only from initcalls/module init functions */
7644int register_btf_kfunc_id_set(enum bpf_prog_type prog_type,
7645			      const struct btf_kfunc_id_set *kset)
7646{
7647	enum btf_kfunc_hook hook;
7648
 
 
 
 
 
 
 
 
7649	hook = bpf_prog_type_to_kfunc_hook(prog_type);
7650	return __register_btf_kfunc_id_set(hook, kset);
7651}
7652EXPORT_SYMBOL_GPL(register_btf_kfunc_id_set);
7653
7654/* This function must be invoked only from initcalls/module init functions */
7655int register_btf_fmodret_id_set(const struct btf_kfunc_id_set *kset)
7656{
7657	return __register_btf_kfunc_id_set(BTF_KFUNC_HOOK_FMODRET, kset);
7658}
7659EXPORT_SYMBOL_GPL(register_btf_fmodret_id_set);
7660
7661s32 btf_find_dtor_kfunc(struct btf *btf, u32 btf_id)
7662{
7663	struct btf_id_dtor_kfunc_tab *tab = btf->dtor_kfunc_tab;
7664	struct btf_id_dtor_kfunc *dtor;
7665
7666	if (!tab)
7667		return -ENOENT;
7668	/* Even though the size of tab->dtors[0] is > sizeof(u32), we only need
7669	 * to compare the first u32 with btf_id, so we can reuse btf_id_cmp_func.
7670	 */
7671	BUILD_BUG_ON(offsetof(struct btf_id_dtor_kfunc, btf_id) != 0);
7672	dtor = bsearch(&btf_id, tab->dtors, tab->cnt, sizeof(tab->dtors[0]), btf_id_cmp_func);
7673	if (!dtor)
7674		return -ENOENT;
7675	return dtor->kfunc_btf_id;
7676}
7677
7678static int btf_check_dtor_kfuncs(struct btf *btf, const struct btf_id_dtor_kfunc *dtors, u32 cnt)
7679{
7680	const struct btf_type *dtor_func, *dtor_func_proto, *t;
7681	const struct btf_param *args;
7682	s32 dtor_btf_id;
7683	u32 nr_args, i;
7684
7685	for (i = 0; i < cnt; i++) {
7686		dtor_btf_id = dtors[i].kfunc_btf_id;
7687
7688		dtor_func = btf_type_by_id(btf, dtor_btf_id);
7689		if (!dtor_func || !btf_type_is_func(dtor_func))
7690			return -EINVAL;
7691
7692		dtor_func_proto = btf_type_by_id(btf, dtor_func->type);
7693		if (!dtor_func_proto || !btf_type_is_func_proto(dtor_func_proto))
7694			return -EINVAL;
7695
7696		/* Make sure the prototype of the destructor kfunc is 'void func(type *)' */
7697		t = btf_type_by_id(btf, dtor_func_proto->type);
7698		if (!t || !btf_type_is_void(t))
7699			return -EINVAL;
7700
7701		nr_args = btf_type_vlen(dtor_func_proto);
7702		if (nr_args != 1)
7703			return -EINVAL;
7704		args = btf_params(dtor_func_proto);
7705		t = btf_type_by_id(btf, args[0].type);
7706		/* Allow any pointer type, as width on targets Linux supports
7707		 * will be same for all pointer types (i.e. sizeof(void *))
7708		 */
7709		if (!t || !btf_type_is_ptr(t))
7710			return -EINVAL;
7711	}
7712	return 0;
7713}
7714
7715/* This function must be invoked only from initcalls/module init functions */
7716int register_btf_id_dtor_kfuncs(const struct btf_id_dtor_kfunc *dtors, u32 add_cnt,
7717				struct module *owner)
7718{
7719	struct btf_id_dtor_kfunc_tab *tab;
7720	struct btf *btf;
7721	u32 tab_cnt;
7722	int ret;
7723
7724	btf = btf_get_module_btf(owner);
7725	if (!btf) {
7726		if (!owner && IS_ENABLED(CONFIG_DEBUG_INFO_BTF)) {
7727			pr_err("missing vmlinux BTF, cannot register dtor kfuncs\n");
7728			return -ENOENT;
7729		}
7730		if (owner && IS_ENABLED(CONFIG_DEBUG_INFO_BTF_MODULES)) {
7731			pr_err("missing module BTF, cannot register dtor kfuncs\n");
7732			return -ENOENT;
7733		}
7734		return 0;
7735	}
7736	if (IS_ERR(btf))
7737		return PTR_ERR(btf);
7738
7739	if (add_cnt >= BTF_DTOR_KFUNC_MAX_CNT) {
7740		pr_err("cannot register more than %d kfunc destructors\n", BTF_DTOR_KFUNC_MAX_CNT);
7741		ret = -E2BIG;
7742		goto end;
7743	}
7744
7745	/* Ensure that the prototype of dtor kfuncs being registered is sane */
7746	ret = btf_check_dtor_kfuncs(btf, dtors, add_cnt);
7747	if (ret < 0)
7748		goto end;
7749
7750	tab = btf->dtor_kfunc_tab;
7751	/* Only one call allowed for modules */
7752	if (WARN_ON_ONCE(tab && btf_is_module(btf))) {
7753		ret = -EINVAL;
7754		goto end;
7755	}
7756
7757	tab_cnt = tab ? tab->cnt : 0;
7758	if (tab_cnt > U32_MAX - add_cnt) {
7759		ret = -EOVERFLOW;
7760		goto end;
7761	}
7762	if (tab_cnt + add_cnt >= BTF_DTOR_KFUNC_MAX_CNT) {
7763		pr_err("cannot register more than %d kfunc destructors\n", BTF_DTOR_KFUNC_MAX_CNT);
7764		ret = -E2BIG;
7765		goto end;
7766	}
7767
7768	tab = krealloc(btf->dtor_kfunc_tab,
7769		       offsetof(struct btf_id_dtor_kfunc_tab, dtors[tab_cnt + add_cnt]),
7770		       GFP_KERNEL | __GFP_NOWARN);
7771	if (!tab) {
7772		ret = -ENOMEM;
7773		goto end;
7774	}
7775
7776	if (!btf->dtor_kfunc_tab)
7777		tab->cnt = 0;
7778	btf->dtor_kfunc_tab = tab;
7779
7780	memcpy(tab->dtors + tab->cnt, dtors, add_cnt * sizeof(tab->dtors[0]));
 
 
 
 
 
 
 
7781	tab->cnt += add_cnt;
7782
7783	sort(tab->dtors, tab->cnt, sizeof(tab->dtors[0]), btf_id_cmp_func, NULL);
7784
7785end:
7786	if (ret)
7787		btf_free_dtor_kfunc_tab(btf);
7788	btf_put(btf);
7789	return ret;
7790}
7791EXPORT_SYMBOL_GPL(register_btf_id_dtor_kfuncs);
7792
7793#define MAX_TYPES_ARE_COMPAT_DEPTH 2
7794
7795/* Check local and target types for compatibility. This check is used for
7796 * type-based CO-RE relocations and follow slightly different rules than
7797 * field-based relocations. This function assumes that root types were already
7798 * checked for name match. Beyond that initial root-level name check, names
7799 * are completely ignored. Compatibility rules are as follows:
7800 *   - any two STRUCTs/UNIONs/FWDs/ENUMs/INTs/ENUM64s are considered compatible, but
7801 *     kind should match for local and target types (i.e., STRUCT is not
7802 *     compatible with UNION);
7803 *   - for ENUMs/ENUM64s, the size is ignored;
7804 *   - for INT, size and signedness are ignored;
7805 *   - for ARRAY, dimensionality is ignored, element types are checked for
7806 *     compatibility recursively;
7807 *   - CONST/VOLATILE/RESTRICT modifiers are ignored;
7808 *   - TYPEDEFs/PTRs are compatible if types they pointing to are compatible;
7809 *   - FUNC_PROTOs are compatible if they have compatible signature: same
7810 *     number of input args and compatible return and argument types.
7811 * These rules are not set in stone and probably will be adjusted as we get
7812 * more experience with using BPF CO-RE relocations.
7813 */
7814int bpf_core_types_are_compat(const struct btf *local_btf, __u32 local_id,
7815			      const struct btf *targ_btf, __u32 targ_id)
7816{
7817	return __bpf_core_types_are_compat(local_btf, local_id, targ_btf, targ_id,
7818					   MAX_TYPES_ARE_COMPAT_DEPTH);
7819}
7820
7821#define MAX_TYPES_MATCH_DEPTH 2
7822
7823int bpf_core_types_match(const struct btf *local_btf, u32 local_id,
7824			 const struct btf *targ_btf, u32 targ_id)
7825{
7826	return __bpf_core_types_match(local_btf, local_id, targ_btf, targ_id, false,
7827				      MAX_TYPES_MATCH_DEPTH);
7828}
7829
7830static bool bpf_core_is_flavor_sep(const char *s)
7831{
7832	/* check X___Y name pattern, where X and Y are not underscores */
7833	return s[0] != '_' &&				      /* X */
7834	       s[1] == '_' && s[2] == '_' && s[3] == '_' &&   /* ___ */
7835	       s[4] != '_';				      /* Y */
7836}
7837
7838size_t bpf_core_essential_name_len(const char *name)
7839{
7840	size_t n = strlen(name);
7841	int i;
7842
7843	for (i = n - 5; i >= 0; i--) {
7844		if (bpf_core_is_flavor_sep(name + i))
7845			return i + 1;
7846	}
7847	return n;
7848}
7849
7850struct bpf_cand_cache {
7851	const char *name;
7852	u32 name_len;
7853	u16 kind;
7854	u16 cnt;
7855	struct {
7856		const struct btf *btf;
7857		u32 id;
7858	} cands[];
7859};
7860
7861static void bpf_free_cands(struct bpf_cand_cache *cands)
7862{
7863	if (!cands->cnt)
7864		/* empty candidate array was allocated on stack */
7865		return;
7866	kfree(cands);
7867}
7868
7869static void bpf_free_cands_from_cache(struct bpf_cand_cache *cands)
7870{
7871	kfree(cands->name);
7872	kfree(cands);
7873}
7874
7875#define VMLINUX_CAND_CACHE_SIZE 31
7876static struct bpf_cand_cache *vmlinux_cand_cache[VMLINUX_CAND_CACHE_SIZE];
7877
7878#define MODULE_CAND_CACHE_SIZE 31
7879static struct bpf_cand_cache *module_cand_cache[MODULE_CAND_CACHE_SIZE];
7880
7881static DEFINE_MUTEX(cand_cache_mutex);
7882
7883static void __print_cand_cache(struct bpf_verifier_log *log,
7884			       struct bpf_cand_cache **cache,
7885			       int cache_size)
7886{
7887	struct bpf_cand_cache *cc;
7888	int i, j;
7889
7890	for (i = 0; i < cache_size; i++) {
7891		cc = cache[i];
7892		if (!cc)
7893			continue;
7894		bpf_log(log, "[%d]%s(", i, cc->name);
7895		for (j = 0; j < cc->cnt; j++) {
7896			bpf_log(log, "%d", cc->cands[j].id);
7897			if (j < cc->cnt - 1)
7898				bpf_log(log, " ");
7899		}
7900		bpf_log(log, "), ");
7901	}
7902}
7903
7904static void print_cand_cache(struct bpf_verifier_log *log)
7905{
7906	mutex_lock(&cand_cache_mutex);
7907	bpf_log(log, "vmlinux_cand_cache:");
7908	__print_cand_cache(log, vmlinux_cand_cache, VMLINUX_CAND_CACHE_SIZE);
7909	bpf_log(log, "\nmodule_cand_cache:");
7910	__print_cand_cache(log, module_cand_cache, MODULE_CAND_CACHE_SIZE);
7911	bpf_log(log, "\n");
7912	mutex_unlock(&cand_cache_mutex);
7913}
7914
7915static u32 hash_cands(struct bpf_cand_cache *cands)
7916{
7917	return jhash(cands->name, cands->name_len, 0);
7918}
7919
7920static struct bpf_cand_cache *check_cand_cache(struct bpf_cand_cache *cands,
7921					       struct bpf_cand_cache **cache,
7922					       int cache_size)
7923{
7924	struct bpf_cand_cache *cc = cache[hash_cands(cands) % cache_size];
7925
7926	if (cc && cc->name_len == cands->name_len &&
7927	    !strncmp(cc->name, cands->name, cands->name_len))
7928		return cc;
7929	return NULL;
7930}
7931
7932static size_t sizeof_cands(int cnt)
7933{
7934	return offsetof(struct bpf_cand_cache, cands[cnt]);
7935}
7936
7937static struct bpf_cand_cache *populate_cand_cache(struct bpf_cand_cache *cands,
7938						  struct bpf_cand_cache **cache,
7939						  int cache_size)
7940{
7941	struct bpf_cand_cache **cc = &cache[hash_cands(cands) % cache_size], *new_cands;
7942
7943	if (*cc) {
7944		bpf_free_cands_from_cache(*cc);
7945		*cc = NULL;
7946	}
7947	new_cands = kmemdup(cands, sizeof_cands(cands->cnt), GFP_KERNEL);
7948	if (!new_cands) {
7949		bpf_free_cands(cands);
7950		return ERR_PTR(-ENOMEM);
7951	}
7952	/* strdup the name, since it will stay in cache.
7953	 * the cands->name points to strings in prog's BTF and the prog can be unloaded.
7954	 */
7955	new_cands->name = kmemdup_nul(cands->name, cands->name_len, GFP_KERNEL);
7956	bpf_free_cands(cands);
7957	if (!new_cands->name) {
7958		kfree(new_cands);
7959		return ERR_PTR(-ENOMEM);
7960	}
7961	*cc = new_cands;
7962	return new_cands;
7963}
7964
7965#ifdef CONFIG_DEBUG_INFO_BTF_MODULES
7966static void __purge_cand_cache(struct btf *btf, struct bpf_cand_cache **cache,
7967			       int cache_size)
7968{
7969	struct bpf_cand_cache *cc;
7970	int i, j;
7971
7972	for (i = 0; i < cache_size; i++) {
7973		cc = cache[i];
7974		if (!cc)
7975			continue;
7976		if (!btf) {
7977			/* when new module is loaded purge all of module_cand_cache,
7978			 * since new module might have candidates with the name
7979			 * that matches cached cands.
7980			 */
7981			bpf_free_cands_from_cache(cc);
7982			cache[i] = NULL;
7983			continue;
7984		}
7985		/* when module is unloaded purge cache entries
7986		 * that match module's btf
7987		 */
7988		for (j = 0; j < cc->cnt; j++)
7989			if (cc->cands[j].btf == btf) {
7990				bpf_free_cands_from_cache(cc);
7991				cache[i] = NULL;
7992				break;
7993			}
7994	}
7995
7996}
7997
7998static void purge_cand_cache(struct btf *btf)
7999{
8000	mutex_lock(&cand_cache_mutex);
8001	__purge_cand_cache(btf, module_cand_cache, MODULE_CAND_CACHE_SIZE);
8002	mutex_unlock(&cand_cache_mutex);
8003}
8004#endif
8005
8006static struct bpf_cand_cache *
8007bpf_core_add_cands(struct bpf_cand_cache *cands, const struct btf *targ_btf,
8008		   int targ_start_id)
8009{
8010	struct bpf_cand_cache *new_cands;
8011	const struct btf_type *t;
8012	const char *targ_name;
8013	size_t targ_essent_len;
8014	int n, i;
8015
8016	n = btf_nr_types(targ_btf);
8017	for (i = targ_start_id; i < n; i++) {
8018		t = btf_type_by_id(targ_btf, i);
8019		if (btf_kind(t) != cands->kind)
8020			continue;
8021
8022		targ_name = btf_name_by_offset(targ_btf, t->name_off);
8023		if (!targ_name)
8024			continue;
8025
8026		/* the resched point is before strncmp to make sure that search
8027		 * for non-existing name will have a chance to schedule().
8028		 */
8029		cond_resched();
8030
8031		if (strncmp(cands->name, targ_name, cands->name_len) != 0)
8032			continue;
8033
8034		targ_essent_len = bpf_core_essential_name_len(targ_name);
8035		if (targ_essent_len != cands->name_len)
8036			continue;
8037
8038		/* most of the time there is only one candidate for a given kind+name pair */
8039		new_cands = kmalloc(sizeof_cands(cands->cnt + 1), GFP_KERNEL);
8040		if (!new_cands) {
8041			bpf_free_cands(cands);
8042			return ERR_PTR(-ENOMEM);
8043		}
8044
8045		memcpy(new_cands, cands, sizeof_cands(cands->cnt));
8046		bpf_free_cands(cands);
8047		cands = new_cands;
8048		cands->cands[cands->cnt].btf = targ_btf;
8049		cands->cands[cands->cnt].id = i;
8050		cands->cnt++;
8051	}
8052	return cands;
8053}
8054
8055static struct bpf_cand_cache *
8056bpf_core_find_cands(struct bpf_core_ctx *ctx, u32 local_type_id)
8057{
8058	struct bpf_cand_cache *cands, *cc, local_cand = {};
8059	const struct btf *local_btf = ctx->btf;
8060	const struct btf_type *local_type;
8061	const struct btf *main_btf;
8062	size_t local_essent_len;
8063	struct btf *mod_btf;
8064	const char *name;
8065	int id;
8066
8067	main_btf = bpf_get_btf_vmlinux();
8068	if (IS_ERR(main_btf))
8069		return ERR_CAST(main_btf);
8070	if (!main_btf)
8071		return ERR_PTR(-EINVAL);
8072
8073	local_type = btf_type_by_id(local_btf, local_type_id);
8074	if (!local_type)
8075		return ERR_PTR(-EINVAL);
8076
8077	name = btf_name_by_offset(local_btf, local_type->name_off);
8078	if (str_is_empty(name))
8079		return ERR_PTR(-EINVAL);
8080	local_essent_len = bpf_core_essential_name_len(name);
8081
8082	cands = &local_cand;
8083	cands->name = name;
8084	cands->kind = btf_kind(local_type);
8085	cands->name_len = local_essent_len;
8086
8087	cc = check_cand_cache(cands, vmlinux_cand_cache, VMLINUX_CAND_CACHE_SIZE);
8088	/* cands is a pointer to stack here */
8089	if (cc) {
8090		if (cc->cnt)
8091			return cc;
8092		goto check_modules;
8093	}
8094
8095	/* Attempt to find target candidates in vmlinux BTF first */
8096	cands = bpf_core_add_cands(cands, main_btf, 1);
8097	if (IS_ERR(cands))
8098		return ERR_CAST(cands);
8099
8100	/* cands is a pointer to kmalloced memory here if cands->cnt > 0 */
8101
8102	/* populate cache even when cands->cnt == 0 */
8103	cc = populate_cand_cache(cands, vmlinux_cand_cache, VMLINUX_CAND_CACHE_SIZE);
8104	if (IS_ERR(cc))
8105		return ERR_CAST(cc);
8106
8107	/* if vmlinux BTF has any candidate, don't go for module BTFs */
8108	if (cc->cnt)
8109		return cc;
8110
8111check_modules:
8112	/* cands is a pointer to stack here and cands->cnt == 0 */
8113	cc = check_cand_cache(cands, module_cand_cache, MODULE_CAND_CACHE_SIZE);
8114	if (cc)
8115		/* if cache has it return it even if cc->cnt == 0 */
8116		return cc;
8117
8118	/* If candidate is not found in vmlinux's BTF then search in module's BTFs */
8119	spin_lock_bh(&btf_idr_lock);
8120	idr_for_each_entry(&btf_idr, mod_btf, id) {
8121		if (!btf_is_module(mod_btf))
8122			continue;
8123		/* linear search could be slow hence unlock/lock
8124		 * the IDR to avoiding holding it for too long
8125		 */
8126		btf_get(mod_btf);
8127		spin_unlock_bh(&btf_idr_lock);
8128		cands = bpf_core_add_cands(cands, mod_btf, btf_nr_types(main_btf));
8129		if (IS_ERR(cands)) {
8130			btf_put(mod_btf);
8131			return ERR_CAST(cands);
8132		}
8133		spin_lock_bh(&btf_idr_lock);
8134		btf_put(mod_btf);
8135	}
8136	spin_unlock_bh(&btf_idr_lock);
8137	/* cands is a pointer to kmalloced memory here if cands->cnt > 0
8138	 * or pointer to stack if cands->cnd == 0.
8139	 * Copy it into the cache even when cands->cnt == 0 and
8140	 * return the result.
8141	 */
8142	return populate_cand_cache(cands, module_cand_cache, MODULE_CAND_CACHE_SIZE);
8143}
8144
8145int bpf_core_apply(struct bpf_core_ctx *ctx, const struct bpf_core_relo *relo,
8146		   int relo_idx, void *insn)
8147{
8148	bool need_cands = relo->kind != BPF_CORE_TYPE_ID_LOCAL;
8149	struct bpf_core_cand_list cands = {};
8150	struct bpf_core_relo_res targ_res;
8151	struct bpf_core_spec *specs;
 
8152	int err;
8153
8154	/* ~4k of temp memory necessary to convert LLVM spec like "0:1:0:5"
8155	 * into arrays of btf_ids of struct fields and array indices.
8156	 */
8157	specs = kcalloc(3, sizeof(*specs), GFP_KERNEL);
8158	if (!specs)
8159		return -ENOMEM;
8160
 
 
 
 
 
 
 
 
8161	if (need_cands) {
8162		struct bpf_cand_cache *cc;
8163		int i;
8164
8165		mutex_lock(&cand_cache_mutex);
8166		cc = bpf_core_find_cands(ctx, relo->type_id);
8167		if (IS_ERR(cc)) {
8168			bpf_log(ctx->log, "target candidate search failed for %d\n",
8169				relo->type_id);
8170			err = PTR_ERR(cc);
8171			goto out;
8172		}
8173		if (cc->cnt) {
8174			cands.cands = kcalloc(cc->cnt, sizeof(*cands.cands), GFP_KERNEL);
8175			if (!cands.cands) {
8176				err = -ENOMEM;
8177				goto out;
8178			}
8179		}
8180		for (i = 0; i < cc->cnt; i++) {
8181			bpf_log(ctx->log,
8182				"CO-RE relocating %s %s: found target candidate [%d]\n",
8183				btf_kind_str[cc->kind], cc->name, cc->cands[i].id);
8184			cands.cands[i].btf = cc->cands[i].btf;
8185			cands.cands[i].id = cc->cands[i].id;
8186		}
8187		cands.len = cc->cnt;
8188		/* cand_cache_mutex needs to span the cache lookup and
8189		 * copy of btf pointer into bpf_core_cand_list,
8190		 * since module can be unloaded while bpf_core_calc_relo_insn
8191		 * is working with module's btf.
8192		 */
8193	}
8194
8195	err = bpf_core_calc_relo_insn((void *)ctx->log, relo, relo_idx, ctx->btf, &cands, specs,
8196				      &targ_res);
8197	if (err)
8198		goto out;
8199
8200	err = bpf_core_patch_insn((void *)ctx->log, insn, relo->insn_off / 8, relo, relo_idx,
8201				  &targ_res);
8202
8203out:
8204	kfree(specs);
8205	if (need_cands) {
8206		kfree(cands.cands);
8207		mutex_unlock(&cand_cache_mutex);
8208		if (ctx->log->level & BPF_LOG_LEVEL2)
8209			print_cand_cache(ctx->log);
8210	}
8211	return err;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
8212}
v6.13.7
   1// SPDX-License-Identifier: GPL-2.0
   2/* Copyright (c) 2018 Facebook */
   3
   4#include <uapi/linux/btf.h>
   5#include <uapi/linux/bpf.h>
   6#include <uapi/linux/bpf_perf_event.h>
   7#include <uapi/linux/types.h>
   8#include <linux/seq_file.h>
   9#include <linux/compiler.h>
  10#include <linux/ctype.h>
  11#include <linux/errno.h>
  12#include <linux/slab.h>
  13#include <linux/anon_inodes.h>
  14#include <linux/file.h>
  15#include <linux/uaccess.h>
  16#include <linux/kernel.h>
  17#include <linux/idr.h>
  18#include <linux/sort.h>
  19#include <linux/bpf_verifier.h>
  20#include <linux/btf.h>
  21#include <linux/btf_ids.h>
  22#include <linux/bpf.h>
  23#include <linux/bpf_lsm.h>
  24#include <linux/skmsg.h>
  25#include <linux/perf_event.h>
  26#include <linux/bsearch.h>
  27#include <linux/kobject.h>
  28#include <linux/sysfs.h>
  29
  30#include <net/netfilter/nf_bpf_link.h>
  31
  32#include <net/sock.h>
  33#include <net/xdp.h>
  34#include "../tools/lib/bpf/relo_core.h"
  35
  36/* BTF (BPF Type Format) is the meta data format which describes
  37 * the data types of BPF program/map.  Hence, it basically focus
  38 * on the C programming language which the modern BPF is primary
  39 * using.
  40 *
  41 * ELF Section:
  42 * ~~~~~~~~~~~
  43 * The BTF data is stored under the ".BTF" ELF section
  44 *
  45 * struct btf_type:
  46 * ~~~~~~~~~~~~~~~
  47 * Each 'struct btf_type' object describes a C data type.
  48 * Depending on the type it is describing, a 'struct btf_type'
  49 * object may be followed by more data.  F.e.
  50 * To describe an array, 'struct btf_type' is followed by
  51 * 'struct btf_array'.
  52 *
  53 * 'struct btf_type' and any extra data following it are
  54 * 4 bytes aligned.
  55 *
  56 * Type section:
  57 * ~~~~~~~~~~~~~
  58 * The BTF type section contains a list of 'struct btf_type' objects.
  59 * Each one describes a C type.  Recall from the above section
  60 * that a 'struct btf_type' object could be immediately followed by extra
  61 * data in order to describe some particular C types.
  62 *
  63 * type_id:
  64 * ~~~~~~~
  65 * Each btf_type object is identified by a type_id.  The type_id
  66 * is implicitly implied by the location of the btf_type object in
  67 * the BTF type section.  The first one has type_id 1.  The second
  68 * one has type_id 2...etc.  Hence, an earlier btf_type has
  69 * a smaller type_id.
  70 *
  71 * A btf_type object may refer to another btf_type object by using
  72 * type_id (i.e. the "type" in the "struct btf_type").
  73 *
  74 * NOTE that we cannot assume any reference-order.
  75 * A btf_type object can refer to an earlier btf_type object
  76 * but it can also refer to a later btf_type object.
  77 *
  78 * For example, to describe "const void *".  A btf_type
  79 * object describing "const" may refer to another btf_type
  80 * object describing "void *".  This type-reference is done
  81 * by specifying type_id:
  82 *
  83 * [1] CONST (anon) type_id=2
  84 * [2] PTR (anon) type_id=0
  85 *
  86 * The above is the btf_verifier debug log:
  87 *   - Each line started with "[?]" is a btf_type object
  88 *   - [?] is the type_id of the btf_type object.
  89 *   - CONST/PTR is the BTF_KIND_XXX
  90 *   - "(anon)" is the name of the type.  It just
  91 *     happens that CONST and PTR has no name.
  92 *   - type_id=XXX is the 'u32 type' in btf_type
  93 *
  94 * NOTE: "void" has type_id 0
  95 *
  96 * String section:
  97 * ~~~~~~~~~~~~~~
  98 * The BTF string section contains the names used by the type section.
  99 * Each string is referred by an "offset" from the beginning of the
 100 * string section.
 101 *
 102 * Each string is '\0' terminated.
 103 *
 104 * The first character in the string section must be '\0'
 105 * which is used to mean 'anonymous'. Some btf_type may not
 106 * have a name.
 107 */
 108
 109/* BTF verification:
 110 *
 111 * To verify BTF data, two passes are needed.
 112 *
 113 * Pass #1
 114 * ~~~~~~~
 115 * The first pass is to collect all btf_type objects to
 116 * an array: "btf->types".
 117 *
 118 * Depending on the C type that a btf_type is describing,
 119 * a btf_type may be followed by extra data.  We don't know
 120 * how many btf_type is there, and more importantly we don't
 121 * know where each btf_type is located in the type section.
 122 *
 123 * Without knowing the location of each type_id, most verifications
 124 * cannot be done.  e.g. an earlier btf_type may refer to a later
 125 * btf_type (recall the "const void *" above), so we cannot
 126 * check this type-reference in the first pass.
 127 *
 128 * In the first pass, it still does some verifications (e.g.
 129 * checking the name is a valid offset to the string section).
 130 *
 131 * Pass #2
 132 * ~~~~~~~
 133 * The main focus is to resolve a btf_type that is referring
 134 * to another type.
 135 *
 136 * We have to ensure the referring type:
 137 * 1) does exist in the BTF (i.e. in btf->types[])
 138 * 2) does not cause a loop:
 139 *	struct A {
 140 *		struct B b;
 141 *	};
 142 *
 143 *	struct B {
 144 *		struct A a;
 145 *	};
 146 *
 147 * btf_type_needs_resolve() decides if a btf_type needs
 148 * to be resolved.
 149 *
 150 * The needs_resolve type implements the "resolve()" ops which
 151 * essentially does a DFS and detects backedge.
 152 *
 153 * During resolve (or DFS), different C types have different
 154 * "RESOLVED" conditions.
 155 *
 156 * When resolving a BTF_KIND_STRUCT, we need to resolve all its
 157 * members because a member is always referring to another
 158 * type.  A struct's member can be treated as "RESOLVED" if
 159 * it is referring to a BTF_KIND_PTR.  Otherwise, the
 160 * following valid C struct would be rejected:
 161 *
 162 *	struct A {
 163 *		int m;
 164 *		struct A *a;
 165 *	};
 166 *
 167 * When resolving a BTF_KIND_PTR, it needs to keep resolving if
 168 * it is referring to another BTF_KIND_PTR.  Otherwise, we cannot
 169 * detect a pointer loop, e.g.:
 170 * BTF_KIND_CONST -> BTF_KIND_PTR -> BTF_KIND_CONST -> BTF_KIND_PTR +
 171 *                        ^                                         |
 172 *                        +-----------------------------------------+
 173 *
 174 */
 175
 176#define BITS_PER_U128 (sizeof(u64) * BITS_PER_BYTE * 2)
 177#define BITS_PER_BYTE_MASK (BITS_PER_BYTE - 1)
 178#define BITS_PER_BYTE_MASKED(bits) ((bits) & BITS_PER_BYTE_MASK)
 179#define BITS_ROUNDDOWN_BYTES(bits) ((bits) >> 3)
 180#define BITS_ROUNDUP_BYTES(bits) \
 181	(BITS_ROUNDDOWN_BYTES(bits) + !!BITS_PER_BYTE_MASKED(bits))
 182
 183#define BTF_INFO_MASK 0x9f00ffff
 184#define BTF_INT_MASK 0x0fffffff
 185#define BTF_TYPE_ID_VALID(type_id) ((type_id) <= BTF_MAX_TYPE)
 186#define BTF_STR_OFFSET_VALID(name_off) ((name_off) <= BTF_MAX_NAME_OFFSET)
 187
 188/* 16MB for 64k structs and each has 16 members and
 189 * a few MB spaces for the string section.
 190 * The hard limit is S32_MAX.
 191 */
 192#define BTF_MAX_SIZE (16 * 1024 * 1024)
 193
 194#define for_each_member_from(i, from, struct_type, member)		\
 195	for (i = from, member = btf_type_member(struct_type) + from;	\
 196	     i < btf_type_vlen(struct_type);				\
 197	     i++, member++)
 198
 199#define for_each_vsi_from(i, from, struct_type, member)				\
 200	for (i = from, member = btf_type_var_secinfo(struct_type) + from;	\
 201	     i < btf_type_vlen(struct_type);					\
 202	     i++, member++)
 203
 204DEFINE_IDR(btf_idr);
 205DEFINE_SPINLOCK(btf_idr_lock);
 206
 207enum btf_kfunc_hook {
 208	BTF_KFUNC_HOOK_COMMON,
 209	BTF_KFUNC_HOOK_XDP,
 210	BTF_KFUNC_HOOK_TC,
 211	BTF_KFUNC_HOOK_STRUCT_OPS,
 212	BTF_KFUNC_HOOK_TRACING,
 213	BTF_KFUNC_HOOK_SYSCALL,
 214	BTF_KFUNC_HOOK_FMODRET,
 215	BTF_KFUNC_HOOK_CGROUP,
 216	BTF_KFUNC_HOOK_SCHED_ACT,
 217	BTF_KFUNC_HOOK_SK_SKB,
 218	BTF_KFUNC_HOOK_SOCKET_FILTER,
 219	BTF_KFUNC_HOOK_LWT,
 220	BTF_KFUNC_HOOK_NETFILTER,
 221	BTF_KFUNC_HOOK_KPROBE,
 222	BTF_KFUNC_HOOK_MAX,
 223};
 224
 225enum {
 226	BTF_KFUNC_SET_MAX_CNT = 256,
 227	BTF_DTOR_KFUNC_MAX_CNT = 256,
 228	BTF_KFUNC_FILTER_MAX_CNT = 16,
 229};
 230
 231struct btf_kfunc_hook_filter {
 232	btf_kfunc_filter_t filters[BTF_KFUNC_FILTER_MAX_CNT];
 233	u32 nr_filters;
 234};
 235
 236struct btf_kfunc_set_tab {
 237	struct btf_id_set8 *sets[BTF_KFUNC_HOOK_MAX];
 238	struct btf_kfunc_hook_filter hook_filters[BTF_KFUNC_HOOK_MAX];
 239};
 240
 241struct btf_id_dtor_kfunc_tab {
 242	u32 cnt;
 243	struct btf_id_dtor_kfunc dtors[];
 244};
 245
 246struct btf_struct_ops_tab {
 247	u32 cnt;
 248	u32 capacity;
 249	struct bpf_struct_ops_desc ops[];
 250};
 251
 252struct btf {
 253	void *data;
 254	struct btf_type **types;
 255	u32 *resolved_ids;
 256	u32 *resolved_sizes;
 257	const char *strings;
 258	void *nohdr_data;
 259	struct btf_header hdr;
 260	u32 nr_types; /* includes VOID for base BTF */
 261	u32 types_size;
 262	u32 data_size;
 263	refcount_t refcnt;
 264	u32 id;
 265	struct rcu_head rcu;
 266	struct btf_kfunc_set_tab *kfunc_set_tab;
 267	struct btf_id_dtor_kfunc_tab *dtor_kfunc_tab;
 268	struct btf_struct_metas *struct_meta_tab;
 269	struct btf_struct_ops_tab *struct_ops_tab;
 270
 271	/* split BTF support */
 272	struct btf *base_btf;
 273	u32 start_id; /* first type ID in this BTF (0 for base BTF) */
 274	u32 start_str_off; /* first string offset (0 for base BTF) */
 275	char name[MODULE_NAME_LEN];
 276	bool kernel_btf;
 277	__u32 *base_id_map; /* map from distilled base BTF -> vmlinux BTF ids */
 278};
 279
 280enum verifier_phase {
 281	CHECK_META,
 282	CHECK_TYPE,
 283};
 284
 285struct resolve_vertex {
 286	const struct btf_type *t;
 287	u32 type_id;
 288	u16 next_member;
 289};
 290
 291enum visit_state {
 292	NOT_VISITED,
 293	VISITED,
 294	RESOLVED,
 295};
 296
 297enum resolve_mode {
 298	RESOLVE_TBD,	/* To Be Determined */
 299	RESOLVE_PTR,	/* Resolving for Pointer */
 300	RESOLVE_STRUCT_OR_ARRAY,	/* Resolving for struct/union
 301					 * or array
 302					 */
 303};
 304
 305#define MAX_RESOLVE_DEPTH 32
 306
 307struct btf_sec_info {
 308	u32 off;
 309	u32 len;
 310};
 311
 312struct btf_verifier_env {
 313	struct btf *btf;
 314	u8 *visit_states;
 315	struct resolve_vertex stack[MAX_RESOLVE_DEPTH];
 316	struct bpf_verifier_log log;
 317	u32 log_type_id;
 318	u32 top_stack;
 319	enum verifier_phase phase;
 320	enum resolve_mode resolve_mode;
 321};
 322
 323static const char * const btf_kind_str[NR_BTF_KINDS] = {
 324	[BTF_KIND_UNKN]		= "UNKNOWN",
 325	[BTF_KIND_INT]		= "INT",
 326	[BTF_KIND_PTR]		= "PTR",
 327	[BTF_KIND_ARRAY]	= "ARRAY",
 328	[BTF_KIND_STRUCT]	= "STRUCT",
 329	[BTF_KIND_UNION]	= "UNION",
 330	[BTF_KIND_ENUM]		= "ENUM",
 331	[BTF_KIND_FWD]		= "FWD",
 332	[BTF_KIND_TYPEDEF]	= "TYPEDEF",
 333	[BTF_KIND_VOLATILE]	= "VOLATILE",
 334	[BTF_KIND_CONST]	= "CONST",
 335	[BTF_KIND_RESTRICT]	= "RESTRICT",
 336	[BTF_KIND_FUNC]		= "FUNC",
 337	[BTF_KIND_FUNC_PROTO]	= "FUNC_PROTO",
 338	[BTF_KIND_VAR]		= "VAR",
 339	[BTF_KIND_DATASEC]	= "DATASEC",
 340	[BTF_KIND_FLOAT]	= "FLOAT",
 341	[BTF_KIND_DECL_TAG]	= "DECL_TAG",
 342	[BTF_KIND_TYPE_TAG]	= "TYPE_TAG",
 343	[BTF_KIND_ENUM64]	= "ENUM64",
 344};
 345
 346const char *btf_type_str(const struct btf_type *t)
 347{
 348	return btf_kind_str[BTF_INFO_KIND(t->info)];
 349}
 350
 351/* Chunk size we use in safe copy of data to be shown. */
 352#define BTF_SHOW_OBJ_SAFE_SIZE		32
 353
 354/*
 355 * This is the maximum size of a base type value (equivalent to a
 356 * 128-bit int); if we are at the end of our safe buffer and have
 357 * less than 16 bytes space we can't be assured of being able
 358 * to copy the next type safely, so in such cases we will initiate
 359 * a new copy.
 360 */
 361#define BTF_SHOW_OBJ_BASE_TYPE_SIZE	16
 362
 363/* Type name size */
 364#define BTF_SHOW_NAME_SIZE		80
 365
 366/*
 367 * The suffix of a type that indicates it cannot alias another type when
 368 * comparing BTF IDs for kfunc invocations.
 369 */
 370#define NOCAST_ALIAS_SUFFIX		"___init"
 371
 372/*
 373 * Common data to all BTF show operations. Private show functions can add
 374 * their own data to a structure containing a struct btf_show and consult it
 375 * in the show callback.  See btf_type_show() below.
 376 *
 377 * One challenge with showing nested data is we want to skip 0-valued
 378 * data, but in order to figure out whether a nested object is all zeros
 379 * we need to walk through it.  As a result, we need to make two passes
 380 * when handling structs, unions and arrays; the first path simply looks
 381 * for nonzero data, while the second actually does the display.  The first
 382 * pass is signalled by show->state.depth_check being set, and if we
 383 * encounter a non-zero value we set show->state.depth_to_show to
 384 * the depth at which we encountered it.  When we have completed the
 385 * first pass, we will know if anything needs to be displayed if
 386 * depth_to_show > depth.  See btf_[struct,array]_show() for the
 387 * implementation of this.
 388 *
 389 * Another problem is we want to ensure the data for display is safe to
 390 * access.  To support this, the anonymous "struct {} obj" tracks the data
 391 * object and our safe copy of it.  We copy portions of the data needed
 392 * to the object "copy" buffer, but because its size is limited to
 393 * BTF_SHOW_OBJ_COPY_LEN bytes, multiple copies may be required as we
 394 * traverse larger objects for display.
 395 *
 396 * The various data type show functions all start with a call to
 397 * btf_show_start_type() which returns a pointer to the safe copy
 398 * of the data needed (or if BTF_SHOW_UNSAFE is specified, to the
 399 * raw data itself).  btf_show_obj_safe() is responsible for
 400 * using copy_from_kernel_nofault() to update the safe data if necessary
 401 * as we traverse the object's data.  skbuff-like semantics are
 402 * used:
 403 *
 404 * - obj.head points to the start of the toplevel object for display
 405 * - obj.size is the size of the toplevel object
 406 * - obj.data points to the current point in the original data at
 407 *   which our safe data starts.  obj.data will advance as we copy
 408 *   portions of the data.
 409 *
 410 * In most cases a single copy will suffice, but larger data structures
 411 * such as "struct task_struct" will require many copies.  The logic in
 412 * btf_show_obj_safe() handles the logic that determines if a new
 413 * copy_from_kernel_nofault() is needed.
 414 */
 415struct btf_show {
 416	u64 flags;
 417	void *target;	/* target of show operation (seq file, buffer) */
 418	__printf(2, 0) void (*showfn)(struct btf_show *show, const char *fmt, va_list args);
 419	const struct btf *btf;
 420	/* below are used during iteration */
 421	struct {
 422		u8 depth;
 423		u8 depth_to_show;
 424		u8 depth_check;
 425		u8 array_member:1,
 426		   array_terminated:1;
 427		u16 array_encoding;
 428		u32 type_id;
 429		int status;			/* non-zero for error */
 430		const struct btf_type *type;
 431		const struct btf_member *member;
 432		char name[BTF_SHOW_NAME_SIZE];	/* space for member name/type */
 433	} state;
 434	struct {
 435		u32 size;
 436		void *head;
 437		void *data;
 438		u8 safe[BTF_SHOW_OBJ_SAFE_SIZE];
 439	} obj;
 440};
 441
 442struct btf_kind_operations {
 443	s32 (*check_meta)(struct btf_verifier_env *env,
 444			  const struct btf_type *t,
 445			  u32 meta_left);
 446	int (*resolve)(struct btf_verifier_env *env,
 447		       const struct resolve_vertex *v);
 448	int (*check_member)(struct btf_verifier_env *env,
 449			    const struct btf_type *struct_type,
 450			    const struct btf_member *member,
 451			    const struct btf_type *member_type);
 452	int (*check_kflag_member)(struct btf_verifier_env *env,
 453				  const struct btf_type *struct_type,
 454				  const struct btf_member *member,
 455				  const struct btf_type *member_type);
 456	void (*log_details)(struct btf_verifier_env *env,
 457			    const struct btf_type *t);
 458	void (*show)(const struct btf *btf, const struct btf_type *t,
 459			 u32 type_id, void *data, u8 bits_offsets,
 460			 struct btf_show *show);
 461};
 462
 463static const struct btf_kind_operations * const kind_ops[NR_BTF_KINDS];
 464static struct btf_type btf_void;
 465
 466static int btf_resolve(struct btf_verifier_env *env,
 467		       const struct btf_type *t, u32 type_id);
 468
 469static int btf_func_check(struct btf_verifier_env *env,
 470			  const struct btf_type *t);
 471
 472static bool btf_type_is_modifier(const struct btf_type *t)
 473{
 474	/* Some of them is not strictly a C modifier
 475	 * but they are grouped into the same bucket
 476	 * for BTF concern:
 477	 *   A type (t) that refers to another
 478	 *   type through t->type AND its size cannot
 479	 *   be determined without following the t->type.
 480	 *
 481	 * ptr does not fall into this bucket
 482	 * because its size is always sizeof(void *).
 483	 */
 484	switch (BTF_INFO_KIND(t->info)) {
 485	case BTF_KIND_TYPEDEF:
 486	case BTF_KIND_VOLATILE:
 487	case BTF_KIND_CONST:
 488	case BTF_KIND_RESTRICT:
 489	case BTF_KIND_TYPE_TAG:
 490		return true;
 491	}
 492
 493	return false;
 494}
 495
 496bool btf_type_is_void(const struct btf_type *t)
 497{
 498	return t == &btf_void;
 499}
 500
 501static bool btf_type_is_datasec(const struct btf_type *t)
 502{
 503	return BTF_INFO_KIND(t->info) == BTF_KIND_DATASEC;
 504}
 505
 506static bool btf_type_is_decl_tag(const struct btf_type *t)
 507{
 508	return BTF_INFO_KIND(t->info) == BTF_KIND_DECL_TAG;
 509}
 510
 511static bool btf_type_nosize(const struct btf_type *t)
 512{
 513	return btf_type_is_void(t) || btf_type_is_fwd(t) ||
 514	       btf_type_is_func(t) || btf_type_is_func_proto(t) ||
 515	       btf_type_is_decl_tag(t);
 516}
 517
 518static bool btf_type_nosize_or_null(const struct btf_type *t)
 519{
 520	return !t || btf_type_nosize(t);
 521}
 522
 
 
 
 
 
 
 
 
 
 
 523static bool btf_type_is_decl_tag_target(const struct btf_type *t)
 524{
 525	return btf_type_is_func(t) || btf_type_is_struct(t) ||
 526	       btf_type_is_var(t) || btf_type_is_typedef(t);
 527}
 528
 529bool btf_is_vmlinux(const struct btf *btf)
 530{
 531	return btf->kernel_btf && !btf->base_btf;
 532}
 533
 534u32 btf_nr_types(const struct btf *btf)
 535{
 536	u32 total = 0;
 537
 538	while (btf) {
 539		total += btf->nr_types;
 540		btf = btf->base_btf;
 541	}
 542
 543	return total;
 544}
 545
 546s32 btf_find_by_name_kind(const struct btf *btf, const char *name, u8 kind)
 547{
 548	const struct btf_type *t;
 549	const char *tname;
 550	u32 i, total;
 551
 552	total = btf_nr_types(btf);
 553	for (i = 1; i < total; i++) {
 554		t = btf_type_by_id(btf, i);
 555		if (BTF_INFO_KIND(t->info) != kind)
 556			continue;
 557
 558		tname = btf_name_by_offset(btf, t->name_off);
 559		if (!strcmp(tname, name))
 560			return i;
 561	}
 562
 563	return -ENOENT;
 564}
 565
 566s32 bpf_find_btf_id(const char *name, u32 kind, struct btf **btf_p)
 567{
 568	struct btf *btf;
 569	s32 ret;
 570	int id;
 571
 572	btf = bpf_get_btf_vmlinux();
 573	if (IS_ERR(btf))
 574		return PTR_ERR(btf);
 575	if (!btf)
 576		return -EINVAL;
 577
 578	ret = btf_find_by_name_kind(btf, name, kind);
 579	/* ret is never zero, since btf_find_by_name_kind returns
 580	 * positive btf_id or negative error.
 581	 */
 582	if (ret > 0) {
 583		btf_get(btf);
 584		*btf_p = btf;
 585		return ret;
 586	}
 587
 588	/* If name is not found in vmlinux's BTF then search in module's BTFs */
 589	spin_lock_bh(&btf_idr_lock);
 590	idr_for_each_entry(&btf_idr, btf, id) {
 591		if (!btf_is_module(btf))
 592			continue;
 593		/* linear search could be slow hence unlock/lock
 594		 * the IDR to avoiding holding it for too long
 595		 */
 596		btf_get(btf);
 597		spin_unlock_bh(&btf_idr_lock);
 598		ret = btf_find_by_name_kind(btf, name, kind);
 599		if (ret > 0) {
 600			*btf_p = btf;
 601			return ret;
 602		}
 
 603		btf_put(btf);
 604		spin_lock_bh(&btf_idr_lock);
 605	}
 606	spin_unlock_bh(&btf_idr_lock);
 607	return ret;
 608}
 609
 610const struct btf_type *btf_type_skip_modifiers(const struct btf *btf,
 611					       u32 id, u32 *res_id)
 612{
 613	const struct btf_type *t = btf_type_by_id(btf, id);
 614
 615	while (btf_type_is_modifier(t)) {
 616		id = t->type;
 617		t = btf_type_by_id(btf, t->type);
 618	}
 619
 620	if (res_id)
 621		*res_id = id;
 622
 623	return t;
 624}
 625
 626const struct btf_type *btf_type_resolve_ptr(const struct btf *btf,
 627					    u32 id, u32 *res_id)
 628{
 629	const struct btf_type *t;
 630
 631	t = btf_type_skip_modifiers(btf, id, NULL);
 632	if (!btf_type_is_ptr(t))
 633		return NULL;
 634
 635	return btf_type_skip_modifiers(btf, t->type, res_id);
 636}
 637
 638const struct btf_type *btf_type_resolve_func_ptr(const struct btf *btf,
 639						 u32 id, u32 *res_id)
 640{
 641	const struct btf_type *ptype;
 642
 643	ptype = btf_type_resolve_ptr(btf, id, res_id);
 644	if (ptype && btf_type_is_func_proto(ptype))
 645		return ptype;
 646
 647	return NULL;
 648}
 649
 650/* Types that act only as a source, not sink or intermediate
 651 * type when resolving.
 652 */
 653static bool btf_type_is_resolve_source_only(const struct btf_type *t)
 654{
 655	return btf_type_is_var(t) ||
 656	       btf_type_is_decl_tag(t) ||
 657	       btf_type_is_datasec(t);
 658}
 659
 660/* What types need to be resolved?
 661 *
 662 * btf_type_is_modifier() is an obvious one.
 663 *
 664 * btf_type_is_struct() because its member refers to
 665 * another type (through member->type).
 666 *
 667 * btf_type_is_var() because the variable refers to
 668 * another type. btf_type_is_datasec() holds multiple
 669 * btf_type_is_var() types that need resolving.
 670 *
 671 * btf_type_is_array() because its element (array->type)
 672 * refers to another type.  Array can be thought of a
 673 * special case of struct while array just has the same
 674 * member-type repeated by array->nelems of times.
 675 */
 676static bool btf_type_needs_resolve(const struct btf_type *t)
 677{
 678	return btf_type_is_modifier(t) ||
 679	       btf_type_is_ptr(t) ||
 680	       btf_type_is_struct(t) ||
 681	       btf_type_is_array(t) ||
 682	       btf_type_is_var(t) ||
 683	       btf_type_is_func(t) ||
 684	       btf_type_is_decl_tag(t) ||
 685	       btf_type_is_datasec(t);
 686}
 687
 688/* t->size can be used */
 689static bool btf_type_has_size(const struct btf_type *t)
 690{
 691	switch (BTF_INFO_KIND(t->info)) {
 692	case BTF_KIND_INT:
 693	case BTF_KIND_STRUCT:
 694	case BTF_KIND_UNION:
 695	case BTF_KIND_ENUM:
 696	case BTF_KIND_DATASEC:
 697	case BTF_KIND_FLOAT:
 698	case BTF_KIND_ENUM64:
 699		return true;
 700	}
 701
 702	return false;
 703}
 704
 705static const char *btf_int_encoding_str(u8 encoding)
 706{
 707	if (encoding == 0)
 708		return "(none)";
 709	else if (encoding == BTF_INT_SIGNED)
 710		return "SIGNED";
 711	else if (encoding == BTF_INT_CHAR)
 712		return "CHAR";
 713	else if (encoding == BTF_INT_BOOL)
 714		return "BOOL";
 715	else
 716		return "UNKN";
 717}
 718
 719static u32 btf_type_int(const struct btf_type *t)
 720{
 721	return *(u32 *)(t + 1);
 722}
 723
 724static const struct btf_array *btf_type_array(const struct btf_type *t)
 725{
 726	return (const struct btf_array *)(t + 1);
 727}
 728
 729static const struct btf_enum *btf_type_enum(const struct btf_type *t)
 730{
 731	return (const struct btf_enum *)(t + 1);
 732}
 733
 734static const struct btf_var *btf_type_var(const struct btf_type *t)
 735{
 736	return (const struct btf_var *)(t + 1);
 737}
 738
 739static const struct btf_decl_tag *btf_type_decl_tag(const struct btf_type *t)
 740{
 741	return (const struct btf_decl_tag *)(t + 1);
 742}
 743
 744static const struct btf_enum64 *btf_type_enum64(const struct btf_type *t)
 745{
 746	return (const struct btf_enum64 *)(t + 1);
 747}
 748
 749static const struct btf_kind_operations *btf_type_ops(const struct btf_type *t)
 750{
 751	return kind_ops[BTF_INFO_KIND(t->info)];
 752}
 753
 754static bool btf_name_offset_valid(const struct btf *btf, u32 offset)
 755{
 756	if (!BTF_STR_OFFSET_VALID(offset))
 757		return false;
 758
 759	while (offset < btf->start_str_off)
 760		btf = btf->base_btf;
 761
 762	offset -= btf->start_str_off;
 763	return offset < btf->hdr.str_len;
 764}
 765
 766static bool __btf_name_char_ok(char c, bool first)
 767{
 768	if ((first ? !isalpha(c) :
 769		     !isalnum(c)) &&
 770	    c != '_' &&
 771	    c != '.')
 
 772		return false;
 773	return true;
 774}
 775
 776const char *btf_str_by_offset(const struct btf *btf, u32 offset)
 777{
 778	while (offset < btf->start_str_off)
 779		btf = btf->base_btf;
 780
 781	offset -= btf->start_str_off;
 782	if (offset < btf->hdr.str_len)
 783		return &btf->strings[offset];
 784
 785	return NULL;
 786}
 787
 788static bool btf_name_valid_identifier(const struct btf *btf, u32 offset)
 789{
 790	/* offset must be valid */
 791	const char *src = btf_str_by_offset(btf, offset);
 792	const char *src_limit;
 793
 794	if (!__btf_name_char_ok(*src, true))
 795		return false;
 796
 797	/* set a limit on identifier length */
 798	src_limit = src + KSYM_NAME_LEN;
 799	src++;
 800	while (*src && src < src_limit) {
 801		if (!__btf_name_char_ok(*src, false))
 802			return false;
 803		src++;
 804	}
 805
 806	return !*src;
 807}
 808
 809/* Allow any printable character in DATASEC names */
 
 
 
 
 
 
 
 810static bool btf_name_valid_section(const struct btf *btf, u32 offset)
 811{
 812	/* offset must be valid */
 813	const char *src = btf_str_by_offset(btf, offset);
 814	const char *src_limit;
 815
 816	if (!*src)
 817		return false;
 818
 819	/* set a limit on identifier length */
 820	src_limit = src + KSYM_NAME_LEN;
 821	while (*src && src < src_limit) {
 822		if (!isprint(*src))
 823			return false;
 824		src++;
 825	}
 826
 827	return !*src;
 828}
 829
 830static const char *__btf_name_by_offset(const struct btf *btf, u32 offset)
 831{
 832	const char *name;
 833
 834	if (!offset)
 835		return "(anon)";
 836
 837	name = btf_str_by_offset(btf, offset);
 838	return name ?: "(invalid-name-offset)";
 839}
 840
 841const char *btf_name_by_offset(const struct btf *btf, u32 offset)
 842{
 843	return btf_str_by_offset(btf, offset);
 844}
 845
 846const struct btf_type *btf_type_by_id(const struct btf *btf, u32 type_id)
 847{
 848	while (type_id < btf->start_id)
 849		btf = btf->base_btf;
 850
 851	type_id -= btf->start_id;
 852	if (type_id >= btf->nr_types)
 853		return NULL;
 854	return btf->types[type_id];
 855}
 856EXPORT_SYMBOL_GPL(btf_type_by_id);
 857
 858/*
 859 * Regular int is not a bit field and it must be either
 860 * u8/u16/u32/u64 or __int128.
 861 */
 862static bool btf_type_int_is_regular(const struct btf_type *t)
 863{
 864	u8 nr_bits, nr_bytes;
 865	u32 int_data;
 866
 867	int_data = btf_type_int(t);
 868	nr_bits = BTF_INT_BITS(int_data);
 869	nr_bytes = BITS_ROUNDUP_BYTES(nr_bits);
 870	if (BITS_PER_BYTE_MASKED(nr_bits) ||
 871	    BTF_INT_OFFSET(int_data) ||
 872	    (nr_bytes != sizeof(u8) && nr_bytes != sizeof(u16) &&
 873	     nr_bytes != sizeof(u32) && nr_bytes != sizeof(u64) &&
 874	     nr_bytes != (2 * sizeof(u64)))) {
 875		return false;
 876	}
 877
 878	return true;
 879}
 880
 881/*
 882 * Check that given struct member is a regular int with expected
 883 * offset and size.
 884 */
 885bool btf_member_is_reg_int(const struct btf *btf, const struct btf_type *s,
 886			   const struct btf_member *m,
 887			   u32 expected_offset, u32 expected_size)
 888{
 889	const struct btf_type *t;
 890	u32 id, int_data;
 891	u8 nr_bits;
 892
 893	id = m->type;
 894	t = btf_type_id_size(btf, &id, NULL);
 895	if (!t || !btf_type_is_int(t))
 896		return false;
 897
 898	int_data = btf_type_int(t);
 899	nr_bits = BTF_INT_BITS(int_data);
 900	if (btf_type_kflag(s)) {
 901		u32 bitfield_size = BTF_MEMBER_BITFIELD_SIZE(m->offset);
 902		u32 bit_offset = BTF_MEMBER_BIT_OFFSET(m->offset);
 903
 904		/* if kflag set, int should be a regular int and
 905		 * bit offset should be at byte boundary.
 906		 */
 907		return !bitfield_size &&
 908		       BITS_ROUNDUP_BYTES(bit_offset) == expected_offset &&
 909		       BITS_ROUNDUP_BYTES(nr_bits) == expected_size;
 910	}
 911
 912	if (BTF_INT_OFFSET(int_data) ||
 913	    BITS_PER_BYTE_MASKED(m->offset) ||
 914	    BITS_ROUNDUP_BYTES(m->offset) != expected_offset ||
 915	    BITS_PER_BYTE_MASKED(nr_bits) ||
 916	    BITS_ROUNDUP_BYTES(nr_bits) != expected_size)
 917		return false;
 918
 919	return true;
 920}
 921
 922/* Similar to btf_type_skip_modifiers() but does not skip typedefs. */
 923static const struct btf_type *btf_type_skip_qualifiers(const struct btf *btf,
 924						       u32 id)
 925{
 926	const struct btf_type *t = btf_type_by_id(btf, id);
 927
 928	while (btf_type_is_modifier(t) &&
 929	       BTF_INFO_KIND(t->info) != BTF_KIND_TYPEDEF) {
 930		t = btf_type_by_id(btf, t->type);
 931	}
 932
 933	return t;
 934}
 935
 936#define BTF_SHOW_MAX_ITER	10
 937
 938#define BTF_KIND_BIT(kind)	(1ULL << kind)
 939
 940/*
 941 * Populate show->state.name with type name information.
 942 * Format of type name is
 943 *
 944 * [.member_name = ] (type_name)
 945 */
 946static const char *btf_show_name(struct btf_show *show)
 947{
 948	/* BTF_MAX_ITER array suffixes "[]" */
 949	const char *array_suffixes = "[][][][][][][][][][]";
 950	const char *array_suffix = &array_suffixes[strlen(array_suffixes)];
 951	/* BTF_MAX_ITER pointer suffixes "*" */
 952	const char *ptr_suffixes = "**********";
 953	const char *ptr_suffix = &ptr_suffixes[strlen(ptr_suffixes)];
 954	const char *name = NULL, *prefix = "", *parens = "";
 955	const struct btf_member *m = show->state.member;
 956	const struct btf_type *t;
 957	const struct btf_array *array;
 958	u32 id = show->state.type_id;
 959	const char *member = NULL;
 960	bool show_member = false;
 961	u64 kinds = 0;
 962	int i;
 963
 964	show->state.name[0] = '\0';
 965
 966	/*
 967	 * Don't show type name if we're showing an array member;
 968	 * in that case we show the array type so don't need to repeat
 969	 * ourselves for each member.
 970	 */
 971	if (show->state.array_member)
 972		return "";
 973
 974	/* Retrieve member name, if any. */
 975	if (m) {
 976		member = btf_name_by_offset(show->btf, m->name_off);
 977		show_member = strlen(member) > 0;
 978		id = m->type;
 979	}
 980
 981	/*
 982	 * Start with type_id, as we have resolved the struct btf_type *
 983	 * via btf_modifier_show() past the parent typedef to the child
 984	 * struct, int etc it is defined as.  In such cases, the type_id
 985	 * still represents the starting type while the struct btf_type *
 986	 * in our show->state points at the resolved type of the typedef.
 987	 */
 988	t = btf_type_by_id(show->btf, id);
 989	if (!t)
 990		return "";
 991
 992	/*
 993	 * The goal here is to build up the right number of pointer and
 994	 * array suffixes while ensuring the type name for a typedef
 995	 * is represented.  Along the way we accumulate a list of
 996	 * BTF kinds we have encountered, since these will inform later
 997	 * display; for example, pointer types will not require an
 998	 * opening "{" for struct, we will just display the pointer value.
 999	 *
1000	 * We also want to accumulate the right number of pointer or array
1001	 * indices in the format string while iterating until we get to
1002	 * the typedef/pointee/array member target type.
1003	 *
1004	 * We start by pointing at the end of pointer and array suffix
1005	 * strings; as we accumulate pointers and arrays we move the pointer
1006	 * or array string backwards so it will show the expected number of
1007	 * '*' or '[]' for the type.  BTF_SHOW_MAX_ITER of nesting of pointers
1008	 * and/or arrays and typedefs are supported as a precaution.
1009	 *
1010	 * We also want to get typedef name while proceeding to resolve
1011	 * type it points to so that we can add parentheses if it is a
1012	 * "typedef struct" etc.
1013	 */
1014	for (i = 0; i < BTF_SHOW_MAX_ITER; i++) {
1015
1016		switch (BTF_INFO_KIND(t->info)) {
1017		case BTF_KIND_TYPEDEF:
1018			if (!name)
1019				name = btf_name_by_offset(show->btf,
1020							       t->name_off);
1021			kinds |= BTF_KIND_BIT(BTF_KIND_TYPEDEF);
1022			id = t->type;
1023			break;
1024		case BTF_KIND_ARRAY:
1025			kinds |= BTF_KIND_BIT(BTF_KIND_ARRAY);
1026			parens = "[";
1027			if (!t)
1028				return "";
1029			array = btf_type_array(t);
1030			if (array_suffix > array_suffixes)
1031				array_suffix -= 2;
1032			id = array->type;
1033			break;
1034		case BTF_KIND_PTR:
1035			kinds |= BTF_KIND_BIT(BTF_KIND_PTR);
1036			if (ptr_suffix > ptr_suffixes)
1037				ptr_suffix -= 1;
1038			id = t->type;
1039			break;
1040		default:
1041			id = 0;
1042			break;
1043		}
1044		if (!id)
1045			break;
1046		t = btf_type_skip_qualifiers(show->btf, id);
1047	}
1048	/* We may not be able to represent this type; bail to be safe */
1049	if (i == BTF_SHOW_MAX_ITER)
1050		return "";
1051
1052	if (!name)
1053		name = btf_name_by_offset(show->btf, t->name_off);
1054
1055	switch (BTF_INFO_KIND(t->info)) {
1056	case BTF_KIND_STRUCT:
1057	case BTF_KIND_UNION:
1058		prefix = BTF_INFO_KIND(t->info) == BTF_KIND_STRUCT ?
1059			 "struct" : "union";
1060		/* if it's an array of struct/union, parens is already set */
1061		if (!(kinds & (BTF_KIND_BIT(BTF_KIND_ARRAY))))
1062			parens = "{";
1063		break;
1064	case BTF_KIND_ENUM:
1065	case BTF_KIND_ENUM64:
1066		prefix = "enum";
1067		break;
1068	default:
1069		break;
1070	}
1071
1072	/* pointer does not require parens */
1073	if (kinds & BTF_KIND_BIT(BTF_KIND_PTR))
1074		parens = "";
1075	/* typedef does not require struct/union/enum prefix */
1076	if (kinds & BTF_KIND_BIT(BTF_KIND_TYPEDEF))
1077		prefix = "";
1078
1079	if (!name)
1080		name = "";
1081
1082	/* Even if we don't want type name info, we want parentheses etc */
1083	if (show->flags & BTF_SHOW_NONAME)
1084		snprintf(show->state.name, sizeof(show->state.name), "%s",
1085			 parens);
1086	else
1087		snprintf(show->state.name, sizeof(show->state.name),
1088			 "%s%s%s(%s%s%s%s%s%s)%s",
1089			 /* first 3 strings comprise ".member = " */
1090			 show_member ? "." : "",
1091			 show_member ? member : "",
1092			 show_member ? " = " : "",
1093			 /* ...next is our prefix (struct, enum, etc) */
1094			 prefix,
1095			 strlen(prefix) > 0 && strlen(name) > 0 ? " " : "",
1096			 /* ...this is the type name itself */
1097			 name,
1098			 /* ...suffixed by the appropriate '*', '[]' suffixes */
1099			 strlen(ptr_suffix) > 0 ? " " : "", ptr_suffix,
1100			 array_suffix, parens);
1101
1102	return show->state.name;
1103}
1104
1105static const char *__btf_show_indent(struct btf_show *show)
1106{
1107	const char *indents = "                                ";
1108	const char *indent = &indents[strlen(indents)];
1109
1110	if ((indent - show->state.depth) >= indents)
1111		return indent - show->state.depth;
1112	return indents;
1113}
1114
1115static const char *btf_show_indent(struct btf_show *show)
1116{
1117	return show->flags & BTF_SHOW_COMPACT ? "" : __btf_show_indent(show);
1118}
1119
1120static const char *btf_show_newline(struct btf_show *show)
1121{
1122	return show->flags & BTF_SHOW_COMPACT ? "" : "\n";
1123}
1124
1125static const char *btf_show_delim(struct btf_show *show)
1126{
1127	if (show->state.depth == 0)
1128		return "";
1129
1130	if ((show->flags & BTF_SHOW_COMPACT) && show->state.type &&
1131		BTF_INFO_KIND(show->state.type->info) == BTF_KIND_UNION)
1132		return "|";
1133
1134	return ",";
1135}
1136
1137__printf(2, 3) static void btf_show(struct btf_show *show, const char *fmt, ...)
1138{
1139	va_list args;
1140
1141	if (!show->state.depth_check) {
1142		va_start(args, fmt);
1143		show->showfn(show, fmt, args);
1144		va_end(args);
1145	}
1146}
1147
1148/* Macros are used here as btf_show_type_value[s]() prepends and appends
1149 * format specifiers to the format specifier passed in; these do the work of
1150 * adding indentation, delimiters etc while the caller simply has to specify
1151 * the type value(s) in the format specifier + value(s).
1152 */
1153#define btf_show_type_value(show, fmt, value)				       \
1154	do {								       \
1155		if ((value) != (__typeof__(value))0 ||			       \
1156		    (show->flags & BTF_SHOW_ZERO) ||			       \
1157		    show->state.depth == 0) {				       \
1158			btf_show(show, "%s%s" fmt "%s%s",		       \
1159				 btf_show_indent(show),			       \
1160				 btf_show_name(show),			       \
1161				 value, btf_show_delim(show),		       \
1162				 btf_show_newline(show));		       \
1163			if (show->state.depth > show->state.depth_to_show)     \
1164				show->state.depth_to_show = show->state.depth; \
1165		}							       \
1166	} while (0)
1167
1168#define btf_show_type_values(show, fmt, ...)				       \
1169	do {								       \
1170		btf_show(show, "%s%s" fmt "%s%s", btf_show_indent(show),       \
1171			 btf_show_name(show),				       \
1172			 __VA_ARGS__, btf_show_delim(show),		       \
1173			 btf_show_newline(show));			       \
1174		if (show->state.depth > show->state.depth_to_show)	       \
1175			show->state.depth_to_show = show->state.depth;	       \
1176	} while (0)
1177
1178/* How much is left to copy to safe buffer after @data? */
1179static int btf_show_obj_size_left(struct btf_show *show, void *data)
1180{
1181	return show->obj.head + show->obj.size - data;
1182}
1183
1184/* Is object pointed to by @data of @size already copied to our safe buffer? */
1185static bool btf_show_obj_is_safe(struct btf_show *show, void *data, int size)
1186{
1187	return data >= show->obj.data &&
1188	       (data + size) < (show->obj.data + BTF_SHOW_OBJ_SAFE_SIZE);
1189}
1190
1191/*
1192 * If object pointed to by @data of @size falls within our safe buffer, return
1193 * the equivalent pointer to the same safe data.  Assumes
1194 * copy_from_kernel_nofault() has already happened and our safe buffer is
1195 * populated.
1196 */
1197static void *__btf_show_obj_safe(struct btf_show *show, void *data, int size)
1198{
1199	if (btf_show_obj_is_safe(show, data, size))
1200		return show->obj.safe + (data - show->obj.data);
1201	return NULL;
1202}
1203
1204/*
1205 * Return a safe-to-access version of data pointed to by @data.
1206 * We do this by copying the relevant amount of information
1207 * to the struct btf_show obj.safe buffer using copy_from_kernel_nofault().
1208 *
1209 * If BTF_SHOW_UNSAFE is specified, just return data as-is; no
1210 * safe copy is needed.
1211 *
1212 * Otherwise we need to determine if we have the required amount
1213 * of data (determined by the @data pointer and the size of the
1214 * largest base type we can encounter (represented by
1215 * BTF_SHOW_OBJ_BASE_TYPE_SIZE). Having that much data ensures
1216 * that we will be able to print some of the current object,
1217 * and if more is needed a copy will be triggered.
1218 * Some objects such as structs will not fit into the buffer;
1219 * in such cases additional copies when we iterate over their
1220 * members may be needed.
1221 *
1222 * btf_show_obj_safe() is used to return a safe buffer for
1223 * btf_show_start_type(); this ensures that as we recurse into
1224 * nested types we always have safe data for the given type.
1225 * This approach is somewhat wasteful; it's possible for example
1226 * that when iterating over a large union we'll end up copying the
1227 * same data repeatedly, but the goal is safety not performance.
1228 * We use stack data as opposed to per-CPU buffers because the
1229 * iteration over a type can take some time, and preemption handling
1230 * would greatly complicate use of the safe buffer.
1231 */
1232static void *btf_show_obj_safe(struct btf_show *show,
1233			       const struct btf_type *t,
1234			       void *data)
1235{
1236	const struct btf_type *rt;
1237	int size_left, size;
1238	void *safe = NULL;
1239
1240	if (show->flags & BTF_SHOW_UNSAFE)
1241		return data;
1242
1243	rt = btf_resolve_size(show->btf, t, &size);
1244	if (IS_ERR(rt)) {
1245		show->state.status = PTR_ERR(rt);
1246		return NULL;
1247	}
1248
1249	/*
1250	 * Is this toplevel object? If so, set total object size and
1251	 * initialize pointers.  Otherwise check if we still fall within
1252	 * our safe object data.
1253	 */
1254	if (show->state.depth == 0) {
1255		show->obj.size = size;
1256		show->obj.head = data;
1257	} else {
1258		/*
1259		 * If the size of the current object is > our remaining
1260		 * safe buffer we _may_ need to do a new copy.  However
1261		 * consider the case of a nested struct; it's size pushes
1262		 * us over the safe buffer limit, but showing any individual
1263		 * struct members does not.  In such cases, we don't need
1264		 * to initiate a fresh copy yet; however we definitely need
1265		 * at least BTF_SHOW_OBJ_BASE_TYPE_SIZE bytes left
1266		 * in our buffer, regardless of the current object size.
1267		 * The logic here is that as we resolve types we will
1268		 * hit a base type at some point, and we need to be sure
1269		 * the next chunk of data is safely available to display
1270		 * that type info safely.  We cannot rely on the size of
1271		 * the current object here because it may be much larger
1272		 * than our current buffer (e.g. task_struct is 8k).
1273		 * All we want to do here is ensure that we can print the
1274		 * next basic type, which we can if either
1275		 * - the current type size is within the safe buffer; or
1276		 * - at least BTF_SHOW_OBJ_BASE_TYPE_SIZE bytes are left in
1277		 *   the safe buffer.
1278		 */
1279		safe = __btf_show_obj_safe(show, data,
1280					   min(size,
1281					       BTF_SHOW_OBJ_BASE_TYPE_SIZE));
1282	}
1283
1284	/*
1285	 * We need a new copy to our safe object, either because we haven't
1286	 * yet copied and are initializing safe data, or because the data
1287	 * we want falls outside the boundaries of the safe object.
1288	 */
1289	if (!safe) {
1290		size_left = btf_show_obj_size_left(show, data);
1291		if (size_left > BTF_SHOW_OBJ_SAFE_SIZE)
1292			size_left = BTF_SHOW_OBJ_SAFE_SIZE;
1293		show->state.status = copy_from_kernel_nofault(show->obj.safe,
1294							      data, size_left);
1295		if (!show->state.status) {
1296			show->obj.data = data;
1297			safe = show->obj.safe;
1298		}
1299	}
1300
1301	return safe;
1302}
1303
1304/*
1305 * Set the type we are starting to show and return a safe data pointer
1306 * to be used for showing the associated data.
1307 */
1308static void *btf_show_start_type(struct btf_show *show,
1309				 const struct btf_type *t,
1310				 u32 type_id, void *data)
1311{
1312	show->state.type = t;
1313	show->state.type_id = type_id;
1314	show->state.name[0] = '\0';
1315
1316	return btf_show_obj_safe(show, t, data);
1317}
1318
1319static void btf_show_end_type(struct btf_show *show)
1320{
1321	show->state.type = NULL;
1322	show->state.type_id = 0;
1323	show->state.name[0] = '\0';
1324}
1325
1326static void *btf_show_start_aggr_type(struct btf_show *show,
1327				      const struct btf_type *t,
1328				      u32 type_id, void *data)
1329{
1330	void *safe_data = btf_show_start_type(show, t, type_id, data);
1331
1332	if (!safe_data)
1333		return safe_data;
1334
1335	btf_show(show, "%s%s%s", btf_show_indent(show),
1336		 btf_show_name(show),
1337		 btf_show_newline(show));
1338	show->state.depth++;
1339	return safe_data;
1340}
1341
1342static void btf_show_end_aggr_type(struct btf_show *show,
1343				   const char *suffix)
1344{
1345	show->state.depth--;
1346	btf_show(show, "%s%s%s%s", btf_show_indent(show), suffix,
1347		 btf_show_delim(show), btf_show_newline(show));
1348	btf_show_end_type(show);
1349}
1350
1351static void btf_show_start_member(struct btf_show *show,
1352				  const struct btf_member *m)
1353{
1354	show->state.member = m;
1355}
1356
1357static void btf_show_start_array_member(struct btf_show *show)
1358{
1359	show->state.array_member = 1;
1360	btf_show_start_member(show, NULL);
1361}
1362
1363static void btf_show_end_member(struct btf_show *show)
1364{
1365	show->state.member = NULL;
1366}
1367
1368static void btf_show_end_array_member(struct btf_show *show)
1369{
1370	show->state.array_member = 0;
1371	btf_show_end_member(show);
1372}
1373
1374static void *btf_show_start_array_type(struct btf_show *show,
1375				       const struct btf_type *t,
1376				       u32 type_id,
1377				       u16 array_encoding,
1378				       void *data)
1379{
1380	show->state.array_encoding = array_encoding;
1381	show->state.array_terminated = 0;
1382	return btf_show_start_aggr_type(show, t, type_id, data);
1383}
1384
1385static void btf_show_end_array_type(struct btf_show *show)
1386{
1387	show->state.array_encoding = 0;
1388	show->state.array_terminated = 0;
1389	btf_show_end_aggr_type(show, "]");
1390}
1391
1392static void *btf_show_start_struct_type(struct btf_show *show,
1393					const struct btf_type *t,
1394					u32 type_id,
1395					void *data)
1396{
1397	return btf_show_start_aggr_type(show, t, type_id, data);
1398}
1399
1400static void btf_show_end_struct_type(struct btf_show *show)
1401{
1402	btf_show_end_aggr_type(show, "}");
1403}
1404
1405__printf(2, 3) static void __btf_verifier_log(struct bpf_verifier_log *log,
1406					      const char *fmt, ...)
1407{
1408	va_list args;
1409
1410	va_start(args, fmt);
1411	bpf_verifier_vlog(log, fmt, args);
1412	va_end(args);
1413}
1414
1415__printf(2, 3) static void btf_verifier_log(struct btf_verifier_env *env,
1416					    const char *fmt, ...)
1417{
1418	struct bpf_verifier_log *log = &env->log;
1419	va_list args;
1420
1421	if (!bpf_verifier_log_needed(log))
1422		return;
1423
1424	va_start(args, fmt);
1425	bpf_verifier_vlog(log, fmt, args);
1426	va_end(args);
1427}
1428
1429__printf(4, 5) static void __btf_verifier_log_type(struct btf_verifier_env *env,
1430						   const struct btf_type *t,
1431						   bool log_details,
1432						   const char *fmt, ...)
1433{
1434	struct bpf_verifier_log *log = &env->log;
1435	struct btf *btf = env->btf;
1436	va_list args;
1437
1438	if (!bpf_verifier_log_needed(log))
1439		return;
1440
1441	if (log->level == BPF_LOG_KERNEL) {
1442		/* btf verifier prints all types it is processing via
1443		 * btf_verifier_log_type(..., fmt = NULL).
1444		 * Skip those prints for in-kernel BTF verification.
1445		 */
1446		if (!fmt)
1447			return;
1448
1449		/* Skip logging when loading module BTF with mismatches permitted */
1450		if (env->btf->base_btf && IS_ENABLED(CONFIG_MODULE_ALLOW_BTF_MISMATCH))
1451			return;
1452	}
1453
1454	__btf_verifier_log(log, "[%u] %s %s%s",
1455			   env->log_type_id,
1456			   btf_type_str(t),
1457			   __btf_name_by_offset(btf, t->name_off),
1458			   log_details ? " " : "");
1459
1460	if (log_details)
1461		btf_type_ops(t)->log_details(env, t);
1462
1463	if (fmt && *fmt) {
1464		__btf_verifier_log(log, " ");
1465		va_start(args, fmt);
1466		bpf_verifier_vlog(log, fmt, args);
1467		va_end(args);
1468	}
1469
1470	__btf_verifier_log(log, "\n");
1471}
1472
1473#define btf_verifier_log_type(env, t, ...) \
1474	__btf_verifier_log_type((env), (t), true, __VA_ARGS__)
1475#define btf_verifier_log_basic(env, t, ...) \
1476	__btf_verifier_log_type((env), (t), false, __VA_ARGS__)
1477
1478__printf(4, 5)
1479static void btf_verifier_log_member(struct btf_verifier_env *env,
1480				    const struct btf_type *struct_type,
1481				    const struct btf_member *member,
1482				    const char *fmt, ...)
1483{
1484	struct bpf_verifier_log *log = &env->log;
1485	struct btf *btf = env->btf;
1486	va_list args;
1487
1488	if (!bpf_verifier_log_needed(log))
1489		return;
1490
1491	if (log->level == BPF_LOG_KERNEL) {
1492		if (!fmt)
1493			return;
1494
1495		/* Skip logging when loading module BTF with mismatches permitted */
1496		if (env->btf->base_btf && IS_ENABLED(CONFIG_MODULE_ALLOW_BTF_MISMATCH))
1497			return;
1498	}
1499
1500	/* The CHECK_META phase already did a btf dump.
1501	 *
1502	 * If member is logged again, it must hit an error in
1503	 * parsing this member.  It is useful to print out which
1504	 * struct this member belongs to.
1505	 */
1506	if (env->phase != CHECK_META)
1507		btf_verifier_log_type(env, struct_type, NULL);
1508
1509	if (btf_type_kflag(struct_type))
1510		__btf_verifier_log(log,
1511				   "\t%s type_id=%u bitfield_size=%u bits_offset=%u",
1512				   __btf_name_by_offset(btf, member->name_off),
1513				   member->type,
1514				   BTF_MEMBER_BITFIELD_SIZE(member->offset),
1515				   BTF_MEMBER_BIT_OFFSET(member->offset));
1516	else
1517		__btf_verifier_log(log, "\t%s type_id=%u bits_offset=%u",
1518				   __btf_name_by_offset(btf, member->name_off),
1519				   member->type, member->offset);
1520
1521	if (fmt && *fmt) {
1522		__btf_verifier_log(log, " ");
1523		va_start(args, fmt);
1524		bpf_verifier_vlog(log, fmt, args);
1525		va_end(args);
1526	}
1527
1528	__btf_verifier_log(log, "\n");
1529}
1530
1531__printf(4, 5)
1532static void btf_verifier_log_vsi(struct btf_verifier_env *env,
1533				 const struct btf_type *datasec_type,
1534				 const struct btf_var_secinfo *vsi,
1535				 const char *fmt, ...)
1536{
1537	struct bpf_verifier_log *log = &env->log;
1538	va_list args;
1539
1540	if (!bpf_verifier_log_needed(log))
1541		return;
1542	if (log->level == BPF_LOG_KERNEL && !fmt)
1543		return;
1544	if (env->phase != CHECK_META)
1545		btf_verifier_log_type(env, datasec_type, NULL);
1546
1547	__btf_verifier_log(log, "\t type_id=%u offset=%u size=%u",
1548			   vsi->type, vsi->offset, vsi->size);
1549	if (fmt && *fmt) {
1550		__btf_verifier_log(log, " ");
1551		va_start(args, fmt);
1552		bpf_verifier_vlog(log, fmt, args);
1553		va_end(args);
1554	}
1555
1556	__btf_verifier_log(log, "\n");
1557}
1558
1559static void btf_verifier_log_hdr(struct btf_verifier_env *env,
1560				 u32 btf_data_size)
1561{
1562	struct bpf_verifier_log *log = &env->log;
1563	const struct btf *btf = env->btf;
1564	const struct btf_header *hdr;
1565
1566	if (!bpf_verifier_log_needed(log))
1567		return;
1568
1569	if (log->level == BPF_LOG_KERNEL)
1570		return;
1571	hdr = &btf->hdr;
1572	__btf_verifier_log(log, "magic: 0x%x\n", hdr->magic);
1573	__btf_verifier_log(log, "version: %u\n", hdr->version);
1574	__btf_verifier_log(log, "flags: 0x%x\n", hdr->flags);
1575	__btf_verifier_log(log, "hdr_len: %u\n", hdr->hdr_len);
1576	__btf_verifier_log(log, "type_off: %u\n", hdr->type_off);
1577	__btf_verifier_log(log, "type_len: %u\n", hdr->type_len);
1578	__btf_verifier_log(log, "str_off: %u\n", hdr->str_off);
1579	__btf_verifier_log(log, "str_len: %u\n", hdr->str_len);
1580	__btf_verifier_log(log, "btf_total_size: %u\n", btf_data_size);
1581}
1582
1583static int btf_add_type(struct btf_verifier_env *env, struct btf_type *t)
1584{
1585	struct btf *btf = env->btf;
1586
1587	if (btf->types_size == btf->nr_types) {
1588		/* Expand 'types' array */
1589
1590		struct btf_type **new_types;
1591		u32 expand_by, new_size;
1592
1593		if (btf->start_id + btf->types_size == BTF_MAX_TYPE) {
1594			btf_verifier_log(env, "Exceeded max num of types");
1595			return -E2BIG;
1596		}
1597
1598		expand_by = max_t(u32, btf->types_size >> 2, 16);
1599		new_size = min_t(u32, BTF_MAX_TYPE,
1600				 btf->types_size + expand_by);
1601
1602		new_types = kvcalloc(new_size, sizeof(*new_types),
1603				     GFP_KERNEL | __GFP_NOWARN);
1604		if (!new_types)
1605			return -ENOMEM;
1606
1607		if (btf->nr_types == 0) {
1608			if (!btf->base_btf) {
1609				/* lazily init VOID type */
1610				new_types[0] = &btf_void;
1611				btf->nr_types++;
1612			}
1613		} else {
1614			memcpy(new_types, btf->types,
1615			       sizeof(*btf->types) * btf->nr_types);
1616		}
1617
1618		kvfree(btf->types);
1619		btf->types = new_types;
1620		btf->types_size = new_size;
1621	}
1622
1623	btf->types[btf->nr_types++] = t;
1624
1625	return 0;
1626}
1627
1628static int btf_alloc_id(struct btf *btf)
1629{
1630	int id;
1631
1632	idr_preload(GFP_KERNEL);
1633	spin_lock_bh(&btf_idr_lock);
1634	id = idr_alloc_cyclic(&btf_idr, btf, 1, INT_MAX, GFP_ATOMIC);
1635	if (id > 0)
1636		btf->id = id;
1637	spin_unlock_bh(&btf_idr_lock);
1638	idr_preload_end();
1639
1640	if (WARN_ON_ONCE(!id))
1641		return -ENOSPC;
1642
1643	return id > 0 ? 0 : id;
1644}
1645
1646static void btf_free_id(struct btf *btf)
1647{
1648	unsigned long flags;
1649
1650	/*
1651	 * In map-in-map, calling map_delete_elem() on outer
1652	 * map will call bpf_map_put on the inner map.
1653	 * It will then eventually call btf_free_id()
1654	 * on the inner map.  Some of the map_delete_elem()
1655	 * implementation may have irq disabled, so
1656	 * we need to use the _irqsave() version instead
1657	 * of the _bh() version.
1658	 */
1659	spin_lock_irqsave(&btf_idr_lock, flags);
1660	idr_remove(&btf_idr, btf->id);
1661	spin_unlock_irqrestore(&btf_idr_lock, flags);
1662}
1663
1664static void btf_free_kfunc_set_tab(struct btf *btf)
1665{
1666	struct btf_kfunc_set_tab *tab = btf->kfunc_set_tab;
1667	int hook;
1668
1669	if (!tab)
1670		return;
 
 
 
 
 
1671	for (hook = 0; hook < ARRAY_SIZE(tab->sets); hook++)
1672		kfree(tab->sets[hook]);
 
1673	kfree(tab);
1674	btf->kfunc_set_tab = NULL;
1675}
1676
1677static void btf_free_dtor_kfunc_tab(struct btf *btf)
1678{
1679	struct btf_id_dtor_kfunc_tab *tab = btf->dtor_kfunc_tab;
1680
1681	if (!tab)
1682		return;
1683	kfree(tab);
1684	btf->dtor_kfunc_tab = NULL;
1685}
1686
1687static void btf_struct_metas_free(struct btf_struct_metas *tab)
1688{
1689	int i;
1690
1691	if (!tab)
1692		return;
1693	for (i = 0; i < tab->cnt; i++)
1694		btf_record_free(tab->types[i].record);
 
 
1695	kfree(tab);
1696}
1697
1698static void btf_free_struct_meta_tab(struct btf *btf)
1699{
1700	struct btf_struct_metas *tab = btf->struct_meta_tab;
1701
1702	btf_struct_metas_free(tab);
1703	btf->struct_meta_tab = NULL;
1704}
1705
1706static void btf_free_struct_ops_tab(struct btf *btf)
1707{
1708	struct btf_struct_ops_tab *tab = btf->struct_ops_tab;
1709	u32 i;
1710
1711	if (!tab)
1712		return;
1713
1714	for (i = 0; i < tab->cnt; i++)
1715		bpf_struct_ops_desc_release(&tab->ops[i]);
1716
1717	kfree(tab);
1718	btf->struct_ops_tab = NULL;
1719}
1720
1721static void btf_free(struct btf *btf)
1722{
1723	btf_free_struct_meta_tab(btf);
1724	btf_free_dtor_kfunc_tab(btf);
1725	btf_free_kfunc_set_tab(btf);
1726	btf_free_struct_ops_tab(btf);
1727	kvfree(btf->types);
1728	kvfree(btf->resolved_sizes);
1729	kvfree(btf->resolved_ids);
1730	/* vmlinux does not allocate btf->data, it simply points it at
1731	 * __start_BTF.
1732	 */
1733	if (!btf_is_vmlinux(btf))
1734		kvfree(btf->data);
1735	kvfree(btf->base_id_map);
1736	kfree(btf);
1737}
1738
1739static void btf_free_rcu(struct rcu_head *rcu)
1740{
1741	struct btf *btf = container_of(rcu, struct btf, rcu);
1742
1743	btf_free(btf);
1744}
1745
1746const char *btf_get_name(const struct btf *btf)
1747{
1748	return btf->name;
1749}
1750
1751void btf_get(struct btf *btf)
1752{
1753	refcount_inc(&btf->refcnt);
1754}
1755
1756void btf_put(struct btf *btf)
1757{
1758	if (btf && refcount_dec_and_test(&btf->refcnt)) {
1759		btf_free_id(btf);
1760		call_rcu(&btf->rcu, btf_free_rcu);
1761	}
1762}
1763
1764struct btf *btf_base_btf(const struct btf *btf)
1765{
1766	return btf->base_btf;
1767}
1768
1769const struct btf_header *btf_header(const struct btf *btf)
1770{
1771	return &btf->hdr;
1772}
1773
1774void btf_set_base_btf(struct btf *btf, const struct btf *base_btf)
1775{
1776	btf->base_btf = (struct btf *)base_btf;
1777	btf->start_id = btf_nr_types(base_btf);
1778	btf->start_str_off = base_btf->hdr.str_len;
1779}
1780
1781static int env_resolve_init(struct btf_verifier_env *env)
1782{
1783	struct btf *btf = env->btf;
1784	u32 nr_types = btf->nr_types;
1785	u32 *resolved_sizes = NULL;
1786	u32 *resolved_ids = NULL;
1787	u8 *visit_states = NULL;
1788
1789	resolved_sizes = kvcalloc(nr_types, sizeof(*resolved_sizes),
1790				  GFP_KERNEL | __GFP_NOWARN);
1791	if (!resolved_sizes)
1792		goto nomem;
1793
1794	resolved_ids = kvcalloc(nr_types, sizeof(*resolved_ids),
1795				GFP_KERNEL | __GFP_NOWARN);
1796	if (!resolved_ids)
1797		goto nomem;
1798
1799	visit_states = kvcalloc(nr_types, sizeof(*visit_states),
1800				GFP_KERNEL | __GFP_NOWARN);
1801	if (!visit_states)
1802		goto nomem;
1803
1804	btf->resolved_sizes = resolved_sizes;
1805	btf->resolved_ids = resolved_ids;
1806	env->visit_states = visit_states;
1807
1808	return 0;
1809
1810nomem:
1811	kvfree(resolved_sizes);
1812	kvfree(resolved_ids);
1813	kvfree(visit_states);
1814	return -ENOMEM;
1815}
1816
1817static void btf_verifier_env_free(struct btf_verifier_env *env)
1818{
1819	kvfree(env->visit_states);
1820	kfree(env);
1821}
1822
1823static bool env_type_is_resolve_sink(const struct btf_verifier_env *env,
1824				     const struct btf_type *next_type)
1825{
1826	switch (env->resolve_mode) {
1827	case RESOLVE_TBD:
1828		/* int, enum or void is a sink */
1829		return !btf_type_needs_resolve(next_type);
1830	case RESOLVE_PTR:
1831		/* int, enum, void, struct, array, func or func_proto is a sink
1832		 * for ptr
1833		 */
1834		return !btf_type_is_modifier(next_type) &&
1835			!btf_type_is_ptr(next_type);
1836	case RESOLVE_STRUCT_OR_ARRAY:
1837		/* int, enum, void, ptr, func or func_proto is a sink
1838		 * for struct and array
1839		 */
1840		return !btf_type_is_modifier(next_type) &&
1841			!btf_type_is_array(next_type) &&
1842			!btf_type_is_struct(next_type);
1843	default:
1844		BUG();
1845	}
1846}
1847
1848static bool env_type_is_resolved(const struct btf_verifier_env *env,
1849				 u32 type_id)
1850{
1851	/* base BTF types should be resolved by now */
1852	if (type_id < env->btf->start_id)
1853		return true;
1854
1855	return env->visit_states[type_id - env->btf->start_id] == RESOLVED;
1856}
1857
1858static int env_stack_push(struct btf_verifier_env *env,
1859			  const struct btf_type *t, u32 type_id)
1860{
1861	const struct btf *btf = env->btf;
1862	struct resolve_vertex *v;
1863
1864	if (env->top_stack == MAX_RESOLVE_DEPTH)
1865		return -E2BIG;
1866
1867	if (type_id < btf->start_id
1868	    || env->visit_states[type_id - btf->start_id] != NOT_VISITED)
1869		return -EEXIST;
1870
1871	env->visit_states[type_id - btf->start_id] = VISITED;
1872
1873	v = &env->stack[env->top_stack++];
1874	v->t = t;
1875	v->type_id = type_id;
1876	v->next_member = 0;
1877
1878	if (env->resolve_mode == RESOLVE_TBD) {
1879		if (btf_type_is_ptr(t))
1880			env->resolve_mode = RESOLVE_PTR;
1881		else if (btf_type_is_struct(t) || btf_type_is_array(t))
1882			env->resolve_mode = RESOLVE_STRUCT_OR_ARRAY;
1883	}
1884
1885	return 0;
1886}
1887
1888static void env_stack_set_next_member(struct btf_verifier_env *env,
1889				      u16 next_member)
1890{
1891	env->stack[env->top_stack - 1].next_member = next_member;
1892}
1893
1894static void env_stack_pop_resolved(struct btf_verifier_env *env,
1895				   u32 resolved_type_id,
1896				   u32 resolved_size)
1897{
1898	u32 type_id = env->stack[--(env->top_stack)].type_id;
1899	struct btf *btf = env->btf;
1900
1901	type_id -= btf->start_id; /* adjust to local type id */
1902	btf->resolved_sizes[type_id] = resolved_size;
1903	btf->resolved_ids[type_id] = resolved_type_id;
1904	env->visit_states[type_id] = RESOLVED;
1905}
1906
1907static const struct resolve_vertex *env_stack_peak(struct btf_verifier_env *env)
1908{
1909	return env->top_stack ? &env->stack[env->top_stack - 1] : NULL;
1910}
1911
1912/* Resolve the size of a passed-in "type"
1913 *
1914 * type: is an array (e.g. u32 array[x][y])
1915 * return type: type "u32[x][y]", i.e. BTF_KIND_ARRAY,
1916 * *type_size: (x * y * sizeof(u32)).  Hence, *type_size always
1917 *             corresponds to the return type.
1918 * *elem_type: u32
1919 * *elem_id: id of u32
1920 * *total_nelems: (x * y).  Hence, individual elem size is
1921 *                (*type_size / *total_nelems)
1922 * *type_id: id of type if it's changed within the function, 0 if not
1923 *
1924 * type: is not an array (e.g. const struct X)
1925 * return type: type "struct X"
1926 * *type_size: sizeof(struct X)
1927 * *elem_type: same as return type ("struct X")
1928 * *elem_id: 0
1929 * *total_nelems: 1
1930 * *type_id: id of type if it's changed within the function, 0 if not
1931 */
1932static const struct btf_type *
1933__btf_resolve_size(const struct btf *btf, const struct btf_type *type,
1934		   u32 *type_size, const struct btf_type **elem_type,
1935		   u32 *elem_id, u32 *total_nelems, u32 *type_id)
1936{
1937	const struct btf_type *array_type = NULL;
1938	const struct btf_array *array = NULL;
1939	u32 i, size, nelems = 1, id = 0;
1940
1941	for (i = 0; i < MAX_RESOLVE_DEPTH; i++) {
1942		switch (BTF_INFO_KIND(type->info)) {
1943		/* type->size can be used */
1944		case BTF_KIND_INT:
1945		case BTF_KIND_STRUCT:
1946		case BTF_KIND_UNION:
1947		case BTF_KIND_ENUM:
1948		case BTF_KIND_FLOAT:
1949		case BTF_KIND_ENUM64:
1950			size = type->size;
1951			goto resolved;
1952
1953		case BTF_KIND_PTR:
1954			size = sizeof(void *);
1955			goto resolved;
1956
1957		/* Modifiers */
1958		case BTF_KIND_TYPEDEF:
1959		case BTF_KIND_VOLATILE:
1960		case BTF_KIND_CONST:
1961		case BTF_KIND_RESTRICT:
1962		case BTF_KIND_TYPE_TAG:
1963			id = type->type;
1964			type = btf_type_by_id(btf, type->type);
1965			break;
1966
1967		case BTF_KIND_ARRAY:
1968			if (!array_type)
1969				array_type = type;
1970			array = btf_type_array(type);
1971			if (nelems && array->nelems > U32_MAX / nelems)
1972				return ERR_PTR(-EINVAL);
1973			nelems *= array->nelems;
1974			type = btf_type_by_id(btf, array->type);
1975			break;
1976
1977		/* type without size */
1978		default:
1979			return ERR_PTR(-EINVAL);
1980		}
1981	}
1982
1983	return ERR_PTR(-EINVAL);
1984
1985resolved:
1986	if (nelems && size > U32_MAX / nelems)
1987		return ERR_PTR(-EINVAL);
1988
1989	*type_size = nelems * size;
1990	if (total_nelems)
1991		*total_nelems = nelems;
1992	if (elem_type)
1993		*elem_type = type;
1994	if (elem_id)
1995		*elem_id = array ? array->type : 0;
1996	if (type_id && id)
1997		*type_id = id;
1998
1999	return array_type ? : type;
2000}
2001
2002const struct btf_type *
2003btf_resolve_size(const struct btf *btf, const struct btf_type *type,
2004		 u32 *type_size)
2005{
2006	return __btf_resolve_size(btf, type, type_size, NULL, NULL, NULL, NULL);
2007}
2008
2009static u32 btf_resolved_type_id(const struct btf *btf, u32 type_id)
2010{
2011	while (type_id < btf->start_id)
2012		btf = btf->base_btf;
2013
2014	return btf->resolved_ids[type_id - btf->start_id];
2015}
2016
2017/* The input param "type_id" must point to a needs_resolve type */
2018static const struct btf_type *btf_type_id_resolve(const struct btf *btf,
2019						  u32 *type_id)
2020{
2021	*type_id = btf_resolved_type_id(btf, *type_id);
2022	return btf_type_by_id(btf, *type_id);
2023}
2024
2025static u32 btf_resolved_type_size(const struct btf *btf, u32 type_id)
2026{
2027	while (type_id < btf->start_id)
2028		btf = btf->base_btf;
2029
2030	return btf->resolved_sizes[type_id - btf->start_id];
2031}
2032
2033const struct btf_type *btf_type_id_size(const struct btf *btf,
2034					u32 *type_id, u32 *ret_size)
2035{
2036	const struct btf_type *size_type;
2037	u32 size_type_id = *type_id;
2038	u32 size = 0;
2039
2040	size_type = btf_type_by_id(btf, size_type_id);
2041	if (btf_type_nosize_or_null(size_type))
2042		return NULL;
2043
2044	if (btf_type_has_size(size_type)) {
2045		size = size_type->size;
2046	} else if (btf_type_is_array(size_type)) {
2047		size = btf_resolved_type_size(btf, size_type_id);
2048	} else if (btf_type_is_ptr(size_type)) {
2049		size = sizeof(void *);
2050	} else {
2051		if (WARN_ON_ONCE(!btf_type_is_modifier(size_type) &&
2052				 !btf_type_is_var(size_type)))
2053			return NULL;
2054
2055		size_type_id = btf_resolved_type_id(btf, size_type_id);
2056		size_type = btf_type_by_id(btf, size_type_id);
2057		if (btf_type_nosize_or_null(size_type))
2058			return NULL;
2059		else if (btf_type_has_size(size_type))
2060			size = size_type->size;
2061		else if (btf_type_is_array(size_type))
2062			size = btf_resolved_type_size(btf, size_type_id);
2063		else if (btf_type_is_ptr(size_type))
2064			size = sizeof(void *);
2065		else
2066			return NULL;
2067	}
2068
2069	*type_id = size_type_id;
2070	if (ret_size)
2071		*ret_size = size;
2072
2073	return size_type;
2074}
2075
2076static int btf_df_check_member(struct btf_verifier_env *env,
2077			       const struct btf_type *struct_type,
2078			       const struct btf_member *member,
2079			       const struct btf_type *member_type)
2080{
2081	btf_verifier_log_basic(env, struct_type,
2082			       "Unsupported check_member");
2083	return -EINVAL;
2084}
2085
2086static int btf_df_check_kflag_member(struct btf_verifier_env *env,
2087				     const struct btf_type *struct_type,
2088				     const struct btf_member *member,
2089				     const struct btf_type *member_type)
2090{
2091	btf_verifier_log_basic(env, struct_type,
2092			       "Unsupported check_kflag_member");
2093	return -EINVAL;
2094}
2095
2096/* Used for ptr, array struct/union and float type members.
2097 * int, enum and modifier types have their specific callback functions.
2098 */
2099static int btf_generic_check_kflag_member(struct btf_verifier_env *env,
2100					  const struct btf_type *struct_type,
2101					  const struct btf_member *member,
2102					  const struct btf_type *member_type)
2103{
2104	if (BTF_MEMBER_BITFIELD_SIZE(member->offset)) {
2105		btf_verifier_log_member(env, struct_type, member,
2106					"Invalid member bitfield_size");
2107		return -EINVAL;
2108	}
2109
2110	/* bitfield size is 0, so member->offset represents bit offset only.
2111	 * It is safe to call non kflag check_member variants.
2112	 */
2113	return btf_type_ops(member_type)->check_member(env, struct_type,
2114						       member,
2115						       member_type);
2116}
2117
2118static int btf_df_resolve(struct btf_verifier_env *env,
2119			  const struct resolve_vertex *v)
2120{
2121	btf_verifier_log_basic(env, v->t, "Unsupported resolve");
2122	return -EINVAL;
2123}
2124
2125static void btf_df_show(const struct btf *btf, const struct btf_type *t,
2126			u32 type_id, void *data, u8 bits_offsets,
2127			struct btf_show *show)
2128{
2129	btf_show(show, "<unsupported kind:%u>", BTF_INFO_KIND(t->info));
2130}
2131
2132static int btf_int_check_member(struct btf_verifier_env *env,
2133				const struct btf_type *struct_type,
2134				const struct btf_member *member,
2135				const struct btf_type *member_type)
2136{
2137	u32 int_data = btf_type_int(member_type);
2138	u32 struct_bits_off = member->offset;
2139	u32 struct_size = struct_type->size;
2140	u32 nr_copy_bits;
2141	u32 bytes_offset;
2142
2143	if (U32_MAX - struct_bits_off < BTF_INT_OFFSET(int_data)) {
2144		btf_verifier_log_member(env, struct_type, member,
2145					"bits_offset exceeds U32_MAX");
2146		return -EINVAL;
2147	}
2148
2149	struct_bits_off += BTF_INT_OFFSET(int_data);
2150	bytes_offset = BITS_ROUNDDOWN_BYTES(struct_bits_off);
2151	nr_copy_bits = BTF_INT_BITS(int_data) +
2152		BITS_PER_BYTE_MASKED(struct_bits_off);
2153
2154	if (nr_copy_bits > BITS_PER_U128) {
2155		btf_verifier_log_member(env, struct_type, member,
2156					"nr_copy_bits exceeds 128");
2157		return -EINVAL;
2158	}
2159
2160	if (struct_size < bytes_offset ||
2161	    struct_size - bytes_offset < BITS_ROUNDUP_BYTES(nr_copy_bits)) {
2162		btf_verifier_log_member(env, struct_type, member,
2163					"Member exceeds struct_size");
2164		return -EINVAL;
2165	}
2166
2167	return 0;
2168}
2169
2170static int btf_int_check_kflag_member(struct btf_verifier_env *env,
2171				      const struct btf_type *struct_type,
2172				      const struct btf_member *member,
2173				      const struct btf_type *member_type)
2174{
2175	u32 struct_bits_off, nr_bits, nr_int_data_bits, bytes_offset;
2176	u32 int_data = btf_type_int(member_type);
2177	u32 struct_size = struct_type->size;
2178	u32 nr_copy_bits;
2179
2180	/* a regular int type is required for the kflag int member */
2181	if (!btf_type_int_is_regular(member_type)) {
2182		btf_verifier_log_member(env, struct_type, member,
2183					"Invalid member base type");
2184		return -EINVAL;
2185	}
2186
2187	/* check sanity of bitfield size */
2188	nr_bits = BTF_MEMBER_BITFIELD_SIZE(member->offset);
2189	struct_bits_off = BTF_MEMBER_BIT_OFFSET(member->offset);
2190	nr_int_data_bits = BTF_INT_BITS(int_data);
2191	if (!nr_bits) {
2192		/* Not a bitfield member, member offset must be at byte
2193		 * boundary.
2194		 */
2195		if (BITS_PER_BYTE_MASKED(struct_bits_off)) {
2196			btf_verifier_log_member(env, struct_type, member,
2197						"Invalid member offset");
2198			return -EINVAL;
2199		}
2200
2201		nr_bits = nr_int_data_bits;
2202	} else if (nr_bits > nr_int_data_bits) {
2203		btf_verifier_log_member(env, struct_type, member,
2204					"Invalid member bitfield_size");
2205		return -EINVAL;
2206	}
2207
2208	bytes_offset = BITS_ROUNDDOWN_BYTES(struct_bits_off);
2209	nr_copy_bits = nr_bits + BITS_PER_BYTE_MASKED(struct_bits_off);
2210	if (nr_copy_bits > BITS_PER_U128) {
2211		btf_verifier_log_member(env, struct_type, member,
2212					"nr_copy_bits exceeds 128");
2213		return -EINVAL;
2214	}
2215
2216	if (struct_size < bytes_offset ||
2217	    struct_size - bytes_offset < BITS_ROUNDUP_BYTES(nr_copy_bits)) {
2218		btf_verifier_log_member(env, struct_type, member,
2219					"Member exceeds struct_size");
2220		return -EINVAL;
2221	}
2222
2223	return 0;
2224}
2225
2226static s32 btf_int_check_meta(struct btf_verifier_env *env,
2227			      const struct btf_type *t,
2228			      u32 meta_left)
2229{
2230	u32 int_data, nr_bits, meta_needed = sizeof(int_data);
2231	u16 encoding;
2232
2233	if (meta_left < meta_needed) {
2234		btf_verifier_log_basic(env, t,
2235				       "meta_left:%u meta_needed:%u",
2236				       meta_left, meta_needed);
2237		return -EINVAL;
2238	}
2239
2240	if (btf_type_vlen(t)) {
2241		btf_verifier_log_type(env, t, "vlen != 0");
2242		return -EINVAL;
2243	}
2244
2245	if (btf_type_kflag(t)) {
2246		btf_verifier_log_type(env, t, "Invalid btf_info kind_flag");
2247		return -EINVAL;
2248	}
2249
2250	int_data = btf_type_int(t);
2251	if (int_data & ~BTF_INT_MASK) {
2252		btf_verifier_log_basic(env, t, "Invalid int_data:%x",
2253				       int_data);
2254		return -EINVAL;
2255	}
2256
2257	nr_bits = BTF_INT_BITS(int_data) + BTF_INT_OFFSET(int_data);
2258
2259	if (nr_bits > BITS_PER_U128) {
2260		btf_verifier_log_type(env, t, "nr_bits exceeds %zu",
2261				      BITS_PER_U128);
2262		return -EINVAL;
2263	}
2264
2265	if (BITS_ROUNDUP_BYTES(nr_bits) > t->size) {
2266		btf_verifier_log_type(env, t, "nr_bits exceeds type_size");
2267		return -EINVAL;
2268	}
2269
2270	/*
2271	 * Only one of the encoding bits is allowed and it
2272	 * should be sufficient for the pretty print purpose (i.e. decoding).
2273	 * Multiple bits can be allowed later if it is found
2274	 * to be insufficient.
2275	 */
2276	encoding = BTF_INT_ENCODING(int_data);
2277	if (encoding &&
2278	    encoding != BTF_INT_SIGNED &&
2279	    encoding != BTF_INT_CHAR &&
2280	    encoding != BTF_INT_BOOL) {
2281		btf_verifier_log_type(env, t, "Unsupported encoding");
2282		return -ENOTSUPP;
2283	}
2284
2285	btf_verifier_log_type(env, t, NULL);
2286
2287	return meta_needed;
2288}
2289
2290static void btf_int_log(struct btf_verifier_env *env,
2291			const struct btf_type *t)
2292{
2293	int int_data = btf_type_int(t);
2294
2295	btf_verifier_log(env,
2296			 "size=%u bits_offset=%u nr_bits=%u encoding=%s",
2297			 t->size, BTF_INT_OFFSET(int_data),
2298			 BTF_INT_BITS(int_data),
2299			 btf_int_encoding_str(BTF_INT_ENCODING(int_data)));
2300}
2301
2302static void btf_int128_print(struct btf_show *show, void *data)
2303{
2304	/* data points to a __int128 number.
2305	 * Suppose
2306	 *     int128_num = *(__int128 *)data;
2307	 * The below formulas shows what upper_num and lower_num represents:
2308	 *     upper_num = int128_num >> 64;
2309	 *     lower_num = int128_num & 0xffffffffFFFFFFFFULL;
2310	 */
2311	u64 upper_num, lower_num;
2312
2313#ifdef __BIG_ENDIAN_BITFIELD
2314	upper_num = *(u64 *)data;
2315	lower_num = *(u64 *)(data + 8);
2316#else
2317	upper_num = *(u64 *)(data + 8);
2318	lower_num = *(u64 *)data;
2319#endif
2320	if (upper_num == 0)
2321		btf_show_type_value(show, "0x%llx", lower_num);
2322	else
2323		btf_show_type_values(show, "0x%llx%016llx", upper_num,
2324				     lower_num);
2325}
2326
2327static void btf_int128_shift(u64 *print_num, u16 left_shift_bits,
2328			     u16 right_shift_bits)
2329{
2330	u64 upper_num, lower_num;
2331
2332#ifdef __BIG_ENDIAN_BITFIELD
2333	upper_num = print_num[0];
2334	lower_num = print_num[1];
2335#else
2336	upper_num = print_num[1];
2337	lower_num = print_num[0];
2338#endif
2339
2340	/* shake out un-needed bits by shift/or operations */
2341	if (left_shift_bits >= 64) {
2342		upper_num = lower_num << (left_shift_bits - 64);
2343		lower_num = 0;
2344	} else {
2345		upper_num = (upper_num << left_shift_bits) |
2346			    (lower_num >> (64 - left_shift_bits));
2347		lower_num = lower_num << left_shift_bits;
2348	}
2349
2350	if (right_shift_bits >= 64) {
2351		lower_num = upper_num >> (right_shift_bits - 64);
2352		upper_num = 0;
2353	} else {
2354		lower_num = (lower_num >> right_shift_bits) |
2355			    (upper_num << (64 - right_shift_bits));
2356		upper_num = upper_num >> right_shift_bits;
2357	}
2358
2359#ifdef __BIG_ENDIAN_BITFIELD
2360	print_num[0] = upper_num;
2361	print_num[1] = lower_num;
2362#else
2363	print_num[0] = lower_num;
2364	print_num[1] = upper_num;
2365#endif
2366}
2367
2368static void btf_bitfield_show(void *data, u8 bits_offset,
2369			      u8 nr_bits, struct btf_show *show)
2370{
2371	u16 left_shift_bits, right_shift_bits;
2372	u8 nr_copy_bytes;
2373	u8 nr_copy_bits;
2374	u64 print_num[2] = {};
2375
2376	nr_copy_bits = nr_bits + bits_offset;
2377	nr_copy_bytes = BITS_ROUNDUP_BYTES(nr_copy_bits);
2378
2379	memcpy(print_num, data, nr_copy_bytes);
2380
2381#ifdef __BIG_ENDIAN_BITFIELD
2382	left_shift_bits = bits_offset;
2383#else
2384	left_shift_bits = BITS_PER_U128 - nr_copy_bits;
2385#endif
2386	right_shift_bits = BITS_PER_U128 - nr_bits;
2387
2388	btf_int128_shift(print_num, left_shift_bits, right_shift_bits);
2389	btf_int128_print(show, print_num);
2390}
2391
2392
2393static void btf_int_bits_show(const struct btf *btf,
2394			      const struct btf_type *t,
2395			      void *data, u8 bits_offset,
2396			      struct btf_show *show)
2397{
2398	u32 int_data = btf_type_int(t);
2399	u8 nr_bits = BTF_INT_BITS(int_data);
2400	u8 total_bits_offset;
2401
2402	/*
2403	 * bits_offset is at most 7.
2404	 * BTF_INT_OFFSET() cannot exceed 128 bits.
2405	 */
2406	total_bits_offset = bits_offset + BTF_INT_OFFSET(int_data);
2407	data += BITS_ROUNDDOWN_BYTES(total_bits_offset);
2408	bits_offset = BITS_PER_BYTE_MASKED(total_bits_offset);
2409	btf_bitfield_show(data, bits_offset, nr_bits, show);
2410}
2411
2412static void btf_int_show(const struct btf *btf, const struct btf_type *t,
2413			 u32 type_id, void *data, u8 bits_offset,
2414			 struct btf_show *show)
2415{
2416	u32 int_data = btf_type_int(t);
2417	u8 encoding = BTF_INT_ENCODING(int_data);
2418	bool sign = encoding & BTF_INT_SIGNED;
2419	u8 nr_bits = BTF_INT_BITS(int_data);
2420	void *safe_data;
2421
2422	safe_data = btf_show_start_type(show, t, type_id, data);
2423	if (!safe_data)
2424		return;
2425
2426	if (bits_offset || BTF_INT_OFFSET(int_data) ||
2427	    BITS_PER_BYTE_MASKED(nr_bits)) {
2428		btf_int_bits_show(btf, t, safe_data, bits_offset, show);
2429		goto out;
2430	}
2431
2432	switch (nr_bits) {
2433	case 128:
2434		btf_int128_print(show, safe_data);
2435		break;
2436	case 64:
2437		if (sign)
2438			btf_show_type_value(show, "%lld", *(s64 *)safe_data);
2439		else
2440			btf_show_type_value(show, "%llu", *(u64 *)safe_data);
2441		break;
2442	case 32:
2443		if (sign)
2444			btf_show_type_value(show, "%d", *(s32 *)safe_data);
2445		else
2446			btf_show_type_value(show, "%u", *(u32 *)safe_data);
2447		break;
2448	case 16:
2449		if (sign)
2450			btf_show_type_value(show, "%d", *(s16 *)safe_data);
2451		else
2452			btf_show_type_value(show, "%u", *(u16 *)safe_data);
2453		break;
2454	case 8:
2455		if (show->state.array_encoding == BTF_INT_CHAR) {
2456			/* check for null terminator */
2457			if (show->state.array_terminated)
2458				break;
2459			if (*(char *)data == '\0') {
2460				show->state.array_terminated = 1;
2461				break;
2462			}
2463			if (isprint(*(char *)data)) {
2464				btf_show_type_value(show, "'%c'",
2465						    *(char *)safe_data);
2466				break;
2467			}
2468		}
2469		if (sign)
2470			btf_show_type_value(show, "%d", *(s8 *)safe_data);
2471		else
2472			btf_show_type_value(show, "%u", *(u8 *)safe_data);
2473		break;
2474	default:
2475		btf_int_bits_show(btf, t, safe_data, bits_offset, show);
2476		break;
2477	}
2478out:
2479	btf_show_end_type(show);
2480}
2481
2482static const struct btf_kind_operations int_ops = {
2483	.check_meta = btf_int_check_meta,
2484	.resolve = btf_df_resolve,
2485	.check_member = btf_int_check_member,
2486	.check_kflag_member = btf_int_check_kflag_member,
2487	.log_details = btf_int_log,
2488	.show = btf_int_show,
2489};
2490
2491static int btf_modifier_check_member(struct btf_verifier_env *env,
2492				     const struct btf_type *struct_type,
2493				     const struct btf_member *member,
2494				     const struct btf_type *member_type)
2495{
2496	const struct btf_type *resolved_type;
2497	u32 resolved_type_id = member->type;
2498	struct btf_member resolved_member;
2499	struct btf *btf = env->btf;
2500
2501	resolved_type = btf_type_id_size(btf, &resolved_type_id, NULL);
2502	if (!resolved_type) {
2503		btf_verifier_log_member(env, struct_type, member,
2504					"Invalid member");
2505		return -EINVAL;
2506	}
2507
2508	resolved_member = *member;
2509	resolved_member.type = resolved_type_id;
2510
2511	return btf_type_ops(resolved_type)->check_member(env, struct_type,
2512							 &resolved_member,
2513							 resolved_type);
2514}
2515
2516static int btf_modifier_check_kflag_member(struct btf_verifier_env *env,
2517					   const struct btf_type *struct_type,
2518					   const struct btf_member *member,
2519					   const struct btf_type *member_type)
2520{
2521	const struct btf_type *resolved_type;
2522	u32 resolved_type_id = member->type;
2523	struct btf_member resolved_member;
2524	struct btf *btf = env->btf;
2525
2526	resolved_type = btf_type_id_size(btf, &resolved_type_id, NULL);
2527	if (!resolved_type) {
2528		btf_verifier_log_member(env, struct_type, member,
2529					"Invalid member");
2530		return -EINVAL;
2531	}
2532
2533	resolved_member = *member;
2534	resolved_member.type = resolved_type_id;
2535
2536	return btf_type_ops(resolved_type)->check_kflag_member(env, struct_type,
2537							       &resolved_member,
2538							       resolved_type);
2539}
2540
2541static int btf_ptr_check_member(struct btf_verifier_env *env,
2542				const struct btf_type *struct_type,
2543				const struct btf_member *member,
2544				const struct btf_type *member_type)
2545{
2546	u32 struct_size, struct_bits_off, bytes_offset;
2547
2548	struct_size = struct_type->size;
2549	struct_bits_off = member->offset;
2550	bytes_offset = BITS_ROUNDDOWN_BYTES(struct_bits_off);
2551
2552	if (BITS_PER_BYTE_MASKED(struct_bits_off)) {
2553		btf_verifier_log_member(env, struct_type, member,
2554					"Member is not byte aligned");
2555		return -EINVAL;
2556	}
2557
2558	if (struct_size - bytes_offset < sizeof(void *)) {
2559		btf_verifier_log_member(env, struct_type, member,
2560					"Member exceeds struct_size");
2561		return -EINVAL;
2562	}
2563
2564	return 0;
2565}
2566
2567static int btf_ref_type_check_meta(struct btf_verifier_env *env,
2568				   const struct btf_type *t,
2569				   u32 meta_left)
2570{
2571	const char *value;
2572
2573	if (btf_type_vlen(t)) {
2574		btf_verifier_log_type(env, t, "vlen != 0");
2575		return -EINVAL;
2576	}
2577
2578	if (btf_type_kflag(t)) {
2579		btf_verifier_log_type(env, t, "Invalid btf_info kind_flag");
2580		return -EINVAL;
2581	}
2582
2583	if (!BTF_TYPE_ID_VALID(t->type)) {
2584		btf_verifier_log_type(env, t, "Invalid type_id");
2585		return -EINVAL;
2586	}
2587
2588	/* typedef/type_tag type must have a valid name, and other ref types,
2589	 * volatile, const, restrict, should have a null name.
2590	 */
2591	if (BTF_INFO_KIND(t->info) == BTF_KIND_TYPEDEF) {
2592		if (!t->name_off ||
2593		    !btf_name_valid_identifier(env->btf, t->name_off)) {
2594			btf_verifier_log_type(env, t, "Invalid name");
2595			return -EINVAL;
2596		}
2597	} else if (BTF_INFO_KIND(t->info) == BTF_KIND_TYPE_TAG) {
2598		value = btf_name_by_offset(env->btf, t->name_off);
2599		if (!value || !value[0]) {
2600			btf_verifier_log_type(env, t, "Invalid name");
2601			return -EINVAL;
2602		}
2603	} else {
2604		if (t->name_off) {
2605			btf_verifier_log_type(env, t, "Invalid name");
2606			return -EINVAL;
2607		}
2608	}
2609
2610	btf_verifier_log_type(env, t, NULL);
2611
2612	return 0;
2613}
2614
2615static int btf_modifier_resolve(struct btf_verifier_env *env,
2616				const struct resolve_vertex *v)
2617{
2618	const struct btf_type *t = v->t;
2619	const struct btf_type *next_type;
2620	u32 next_type_id = t->type;
2621	struct btf *btf = env->btf;
2622
2623	next_type = btf_type_by_id(btf, next_type_id);
2624	if (!next_type || btf_type_is_resolve_source_only(next_type)) {
2625		btf_verifier_log_type(env, v->t, "Invalid type_id");
2626		return -EINVAL;
2627	}
2628
2629	if (!env_type_is_resolve_sink(env, next_type) &&
2630	    !env_type_is_resolved(env, next_type_id))
2631		return env_stack_push(env, next_type, next_type_id);
2632
2633	/* Figure out the resolved next_type_id with size.
2634	 * They will be stored in the current modifier's
2635	 * resolved_ids and resolved_sizes such that it can
2636	 * save us a few type-following when we use it later (e.g. in
2637	 * pretty print).
2638	 */
2639	if (!btf_type_id_size(btf, &next_type_id, NULL)) {
2640		if (env_type_is_resolved(env, next_type_id))
2641			next_type = btf_type_id_resolve(btf, &next_type_id);
2642
2643		/* "typedef void new_void", "const void"...etc */
2644		if (!btf_type_is_void(next_type) &&
2645		    !btf_type_is_fwd(next_type) &&
2646		    !btf_type_is_func_proto(next_type)) {
2647			btf_verifier_log_type(env, v->t, "Invalid type_id");
2648			return -EINVAL;
2649		}
2650	}
2651
2652	env_stack_pop_resolved(env, next_type_id, 0);
2653
2654	return 0;
2655}
2656
2657static int btf_var_resolve(struct btf_verifier_env *env,
2658			   const struct resolve_vertex *v)
2659{
2660	const struct btf_type *next_type;
2661	const struct btf_type *t = v->t;
2662	u32 next_type_id = t->type;
2663	struct btf *btf = env->btf;
2664
2665	next_type = btf_type_by_id(btf, next_type_id);
2666	if (!next_type || btf_type_is_resolve_source_only(next_type)) {
2667		btf_verifier_log_type(env, v->t, "Invalid type_id");
2668		return -EINVAL;
2669	}
2670
2671	if (!env_type_is_resolve_sink(env, next_type) &&
2672	    !env_type_is_resolved(env, next_type_id))
2673		return env_stack_push(env, next_type, next_type_id);
2674
2675	if (btf_type_is_modifier(next_type)) {
2676		const struct btf_type *resolved_type;
2677		u32 resolved_type_id;
2678
2679		resolved_type_id = next_type_id;
2680		resolved_type = btf_type_id_resolve(btf, &resolved_type_id);
2681
2682		if (btf_type_is_ptr(resolved_type) &&
2683		    !env_type_is_resolve_sink(env, resolved_type) &&
2684		    !env_type_is_resolved(env, resolved_type_id))
2685			return env_stack_push(env, resolved_type,
2686					      resolved_type_id);
2687	}
2688
2689	/* We must resolve to something concrete at this point, no
2690	 * forward types or similar that would resolve to size of
2691	 * zero is allowed.
2692	 */
2693	if (!btf_type_id_size(btf, &next_type_id, NULL)) {
2694		btf_verifier_log_type(env, v->t, "Invalid type_id");
2695		return -EINVAL;
2696	}
2697
2698	env_stack_pop_resolved(env, next_type_id, 0);
2699
2700	return 0;
2701}
2702
2703static int btf_ptr_resolve(struct btf_verifier_env *env,
2704			   const struct resolve_vertex *v)
2705{
2706	const struct btf_type *next_type;
2707	const struct btf_type *t = v->t;
2708	u32 next_type_id = t->type;
2709	struct btf *btf = env->btf;
2710
2711	next_type = btf_type_by_id(btf, next_type_id);
2712	if (!next_type || btf_type_is_resolve_source_only(next_type)) {
2713		btf_verifier_log_type(env, v->t, "Invalid type_id");
2714		return -EINVAL;
2715	}
2716
2717	if (!env_type_is_resolve_sink(env, next_type) &&
2718	    !env_type_is_resolved(env, next_type_id))
2719		return env_stack_push(env, next_type, next_type_id);
2720
2721	/* If the modifier was RESOLVED during RESOLVE_STRUCT_OR_ARRAY,
2722	 * the modifier may have stopped resolving when it was resolved
2723	 * to a ptr (last-resolved-ptr).
2724	 *
2725	 * We now need to continue from the last-resolved-ptr to
2726	 * ensure the last-resolved-ptr will not referring back to
2727	 * the current ptr (t).
2728	 */
2729	if (btf_type_is_modifier(next_type)) {
2730		const struct btf_type *resolved_type;
2731		u32 resolved_type_id;
2732
2733		resolved_type_id = next_type_id;
2734		resolved_type = btf_type_id_resolve(btf, &resolved_type_id);
2735
2736		if (btf_type_is_ptr(resolved_type) &&
2737		    !env_type_is_resolve_sink(env, resolved_type) &&
2738		    !env_type_is_resolved(env, resolved_type_id))
2739			return env_stack_push(env, resolved_type,
2740					      resolved_type_id);
2741	}
2742
2743	if (!btf_type_id_size(btf, &next_type_id, NULL)) {
2744		if (env_type_is_resolved(env, next_type_id))
2745			next_type = btf_type_id_resolve(btf, &next_type_id);
2746
2747		if (!btf_type_is_void(next_type) &&
2748		    !btf_type_is_fwd(next_type) &&
2749		    !btf_type_is_func_proto(next_type)) {
2750			btf_verifier_log_type(env, v->t, "Invalid type_id");
2751			return -EINVAL;
2752		}
2753	}
2754
2755	env_stack_pop_resolved(env, next_type_id, 0);
2756
2757	return 0;
2758}
2759
2760static void btf_modifier_show(const struct btf *btf,
2761			      const struct btf_type *t,
2762			      u32 type_id, void *data,
2763			      u8 bits_offset, struct btf_show *show)
2764{
2765	if (btf->resolved_ids)
2766		t = btf_type_id_resolve(btf, &type_id);
2767	else
2768		t = btf_type_skip_modifiers(btf, type_id, NULL);
2769
2770	btf_type_ops(t)->show(btf, t, type_id, data, bits_offset, show);
2771}
2772
2773static void btf_var_show(const struct btf *btf, const struct btf_type *t,
2774			 u32 type_id, void *data, u8 bits_offset,
2775			 struct btf_show *show)
2776{
2777	t = btf_type_id_resolve(btf, &type_id);
2778
2779	btf_type_ops(t)->show(btf, t, type_id, data, bits_offset, show);
2780}
2781
2782static void btf_ptr_show(const struct btf *btf, const struct btf_type *t,
2783			 u32 type_id, void *data, u8 bits_offset,
2784			 struct btf_show *show)
2785{
2786	void *safe_data;
2787
2788	safe_data = btf_show_start_type(show, t, type_id, data);
2789	if (!safe_data)
2790		return;
2791
2792	/* It is a hashed value unless BTF_SHOW_PTR_RAW is specified */
2793	if (show->flags & BTF_SHOW_PTR_RAW)
2794		btf_show_type_value(show, "0x%px", *(void **)safe_data);
2795	else
2796		btf_show_type_value(show, "0x%p", *(void **)safe_data);
2797	btf_show_end_type(show);
2798}
2799
2800static void btf_ref_type_log(struct btf_verifier_env *env,
2801			     const struct btf_type *t)
2802{
2803	btf_verifier_log(env, "type_id=%u", t->type);
2804}
2805
2806static const struct btf_kind_operations modifier_ops = {
2807	.check_meta = btf_ref_type_check_meta,
2808	.resolve = btf_modifier_resolve,
2809	.check_member = btf_modifier_check_member,
2810	.check_kflag_member = btf_modifier_check_kflag_member,
2811	.log_details = btf_ref_type_log,
2812	.show = btf_modifier_show,
2813};
2814
2815static const struct btf_kind_operations ptr_ops = {
2816	.check_meta = btf_ref_type_check_meta,
2817	.resolve = btf_ptr_resolve,
2818	.check_member = btf_ptr_check_member,
2819	.check_kflag_member = btf_generic_check_kflag_member,
2820	.log_details = btf_ref_type_log,
2821	.show = btf_ptr_show,
2822};
2823
2824static s32 btf_fwd_check_meta(struct btf_verifier_env *env,
2825			      const struct btf_type *t,
2826			      u32 meta_left)
2827{
2828	if (btf_type_vlen(t)) {
2829		btf_verifier_log_type(env, t, "vlen != 0");
2830		return -EINVAL;
2831	}
2832
2833	if (t->type) {
2834		btf_verifier_log_type(env, t, "type != 0");
2835		return -EINVAL;
2836	}
2837
2838	/* fwd type must have a valid name */
2839	if (!t->name_off ||
2840	    !btf_name_valid_identifier(env->btf, t->name_off)) {
2841		btf_verifier_log_type(env, t, "Invalid name");
2842		return -EINVAL;
2843	}
2844
2845	btf_verifier_log_type(env, t, NULL);
2846
2847	return 0;
2848}
2849
2850static void btf_fwd_type_log(struct btf_verifier_env *env,
2851			     const struct btf_type *t)
2852{
2853	btf_verifier_log(env, "%s", btf_type_kflag(t) ? "union" : "struct");
2854}
2855
2856static const struct btf_kind_operations fwd_ops = {
2857	.check_meta = btf_fwd_check_meta,
2858	.resolve = btf_df_resolve,
2859	.check_member = btf_df_check_member,
2860	.check_kflag_member = btf_df_check_kflag_member,
2861	.log_details = btf_fwd_type_log,
2862	.show = btf_df_show,
2863};
2864
2865static int btf_array_check_member(struct btf_verifier_env *env,
2866				  const struct btf_type *struct_type,
2867				  const struct btf_member *member,
2868				  const struct btf_type *member_type)
2869{
2870	u32 struct_bits_off = member->offset;
2871	u32 struct_size, bytes_offset;
2872	u32 array_type_id, array_size;
2873	struct btf *btf = env->btf;
2874
2875	if (BITS_PER_BYTE_MASKED(struct_bits_off)) {
2876		btf_verifier_log_member(env, struct_type, member,
2877					"Member is not byte aligned");
2878		return -EINVAL;
2879	}
2880
2881	array_type_id = member->type;
2882	btf_type_id_size(btf, &array_type_id, &array_size);
2883	struct_size = struct_type->size;
2884	bytes_offset = BITS_ROUNDDOWN_BYTES(struct_bits_off);
2885	if (struct_size - bytes_offset < array_size) {
2886		btf_verifier_log_member(env, struct_type, member,
2887					"Member exceeds struct_size");
2888		return -EINVAL;
2889	}
2890
2891	return 0;
2892}
2893
2894static s32 btf_array_check_meta(struct btf_verifier_env *env,
2895				const struct btf_type *t,
2896				u32 meta_left)
2897{
2898	const struct btf_array *array = btf_type_array(t);
2899	u32 meta_needed = sizeof(*array);
2900
2901	if (meta_left < meta_needed) {
2902		btf_verifier_log_basic(env, t,
2903				       "meta_left:%u meta_needed:%u",
2904				       meta_left, meta_needed);
2905		return -EINVAL;
2906	}
2907
2908	/* array type should not have a name */
2909	if (t->name_off) {
2910		btf_verifier_log_type(env, t, "Invalid name");
2911		return -EINVAL;
2912	}
2913
2914	if (btf_type_vlen(t)) {
2915		btf_verifier_log_type(env, t, "vlen != 0");
2916		return -EINVAL;
2917	}
2918
2919	if (btf_type_kflag(t)) {
2920		btf_verifier_log_type(env, t, "Invalid btf_info kind_flag");
2921		return -EINVAL;
2922	}
2923
2924	if (t->size) {
2925		btf_verifier_log_type(env, t, "size != 0");
2926		return -EINVAL;
2927	}
2928
2929	/* Array elem type and index type cannot be in type void,
2930	 * so !array->type and !array->index_type are not allowed.
2931	 */
2932	if (!array->type || !BTF_TYPE_ID_VALID(array->type)) {
2933		btf_verifier_log_type(env, t, "Invalid elem");
2934		return -EINVAL;
2935	}
2936
2937	if (!array->index_type || !BTF_TYPE_ID_VALID(array->index_type)) {
2938		btf_verifier_log_type(env, t, "Invalid index");
2939		return -EINVAL;
2940	}
2941
2942	btf_verifier_log_type(env, t, NULL);
2943
2944	return meta_needed;
2945}
2946
2947static int btf_array_resolve(struct btf_verifier_env *env,
2948			     const struct resolve_vertex *v)
2949{
2950	const struct btf_array *array = btf_type_array(v->t);
2951	const struct btf_type *elem_type, *index_type;
2952	u32 elem_type_id, index_type_id;
2953	struct btf *btf = env->btf;
2954	u32 elem_size;
2955
2956	/* Check array->index_type */
2957	index_type_id = array->index_type;
2958	index_type = btf_type_by_id(btf, index_type_id);
2959	if (btf_type_nosize_or_null(index_type) ||
2960	    btf_type_is_resolve_source_only(index_type)) {
2961		btf_verifier_log_type(env, v->t, "Invalid index");
2962		return -EINVAL;
2963	}
2964
2965	if (!env_type_is_resolve_sink(env, index_type) &&
2966	    !env_type_is_resolved(env, index_type_id))
2967		return env_stack_push(env, index_type, index_type_id);
2968
2969	index_type = btf_type_id_size(btf, &index_type_id, NULL);
2970	if (!index_type || !btf_type_is_int(index_type) ||
2971	    !btf_type_int_is_regular(index_type)) {
2972		btf_verifier_log_type(env, v->t, "Invalid index");
2973		return -EINVAL;
2974	}
2975
2976	/* Check array->type */
2977	elem_type_id = array->type;
2978	elem_type = btf_type_by_id(btf, elem_type_id);
2979	if (btf_type_nosize_or_null(elem_type) ||
2980	    btf_type_is_resolve_source_only(elem_type)) {
2981		btf_verifier_log_type(env, v->t,
2982				      "Invalid elem");
2983		return -EINVAL;
2984	}
2985
2986	if (!env_type_is_resolve_sink(env, elem_type) &&
2987	    !env_type_is_resolved(env, elem_type_id))
2988		return env_stack_push(env, elem_type, elem_type_id);
2989
2990	elem_type = btf_type_id_size(btf, &elem_type_id, &elem_size);
2991	if (!elem_type) {
2992		btf_verifier_log_type(env, v->t, "Invalid elem");
2993		return -EINVAL;
2994	}
2995
2996	if (btf_type_is_int(elem_type) && !btf_type_int_is_regular(elem_type)) {
2997		btf_verifier_log_type(env, v->t, "Invalid array of int");
2998		return -EINVAL;
2999	}
3000
3001	if (array->nelems && elem_size > U32_MAX / array->nelems) {
3002		btf_verifier_log_type(env, v->t,
3003				      "Array size overflows U32_MAX");
3004		return -EINVAL;
3005	}
3006
3007	env_stack_pop_resolved(env, elem_type_id, elem_size * array->nelems);
3008
3009	return 0;
3010}
3011
3012static void btf_array_log(struct btf_verifier_env *env,
3013			  const struct btf_type *t)
3014{
3015	const struct btf_array *array = btf_type_array(t);
3016
3017	btf_verifier_log(env, "type_id=%u index_type_id=%u nr_elems=%u",
3018			 array->type, array->index_type, array->nelems);
3019}
3020
3021static void __btf_array_show(const struct btf *btf, const struct btf_type *t,
3022			     u32 type_id, void *data, u8 bits_offset,
3023			     struct btf_show *show)
3024{
3025	const struct btf_array *array = btf_type_array(t);
3026	const struct btf_kind_operations *elem_ops;
3027	const struct btf_type *elem_type;
3028	u32 i, elem_size = 0, elem_type_id;
3029	u16 encoding = 0;
3030
3031	elem_type_id = array->type;
3032	elem_type = btf_type_skip_modifiers(btf, elem_type_id, NULL);
3033	if (elem_type && btf_type_has_size(elem_type))
3034		elem_size = elem_type->size;
3035
3036	if (elem_type && btf_type_is_int(elem_type)) {
3037		u32 int_type = btf_type_int(elem_type);
3038
3039		encoding = BTF_INT_ENCODING(int_type);
3040
3041		/*
3042		 * BTF_INT_CHAR encoding never seems to be set for
3043		 * char arrays, so if size is 1 and element is
3044		 * printable as a char, we'll do that.
3045		 */
3046		if (elem_size == 1)
3047			encoding = BTF_INT_CHAR;
3048	}
3049
3050	if (!btf_show_start_array_type(show, t, type_id, encoding, data))
3051		return;
3052
3053	if (!elem_type)
3054		goto out;
3055	elem_ops = btf_type_ops(elem_type);
3056
3057	for (i = 0; i < array->nelems; i++) {
3058
3059		btf_show_start_array_member(show);
3060
3061		elem_ops->show(btf, elem_type, elem_type_id, data,
3062			       bits_offset, show);
3063		data += elem_size;
3064
3065		btf_show_end_array_member(show);
3066
3067		if (show->state.array_terminated)
3068			break;
3069	}
3070out:
3071	btf_show_end_array_type(show);
3072}
3073
3074static void btf_array_show(const struct btf *btf, const struct btf_type *t,
3075			   u32 type_id, void *data, u8 bits_offset,
3076			   struct btf_show *show)
3077{
3078	const struct btf_member *m = show->state.member;
3079
3080	/*
3081	 * First check if any members would be shown (are non-zero).
3082	 * See comments above "struct btf_show" definition for more
3083	 * details on how this works at a high-level.
3084	 */
3085	if (show->state.depth > 0 && !(show->flags & BTF_SHOW_ZERO)) {
3086		if (!show->state.depth_check) {
3087			show->state.depth_check = show->state.depth + 1;
3088			show->state.depth_to_show = 0;
3089		}
3090		__btf_array_show(btf, t, type_id, data, bits_offset, show);
3091		show->state.member = m;
3092
3093		if (show->state.depth_check != show->state.depth + 1)
3094			return;
3095		show->state.depth_check = 0;
3096
3097		if (show->state.depth_to_show <= show->state.depth)
3098			return;
3099		/*
3100		 * Reaching here indicates we have recursed and found
3101		 * non-zero array member(s).
3102		 */
3103	}
3104	__btf_array_show(btf, t, type_id, data, bits_offset, show);
3105}
3106
3107static const struct btf_kind_operations array_ops = {
3108	.check_meta = btf_array_check_meta,
3109	.resolve = btf_array_resolve,
3110	.check_member = btf_array_check_member,
3111	.check_kflag_member = btf_generic_check_kflag_member,
3112	.log_details = btf_array_log,
3113	.show = btf_array_show,
3114};
3115
3116static int btf_struct_check_member(struct btf_verifier_env *env,
3117				   const struct btf_type *struct_type,
3118				   const struct btf_member *member,
3119				   const struct btf_type *member_type)
3120{
3121	u32 struct_bits_off = member->offset;
3122	u32 struct_size, bytes_offset;
3123
3124	if (BITS_PER_BYTE_MASKED(struct_bits_off)) {
3125		btf_verifier_log_member(env, struct_type, member,
3126					"Member is not byte aligned");
3127		return -EINVAL;
3128	}
3129
3130	struct_size = struct_type->size;
3131	bytes_offset = BITS_ROUNDDOWN_BYTES(struct_bits_off);
3132	if (struct_size - bytes_offset < member_type->size) {
3133		btf_verifier_log_member(env, struct_type, member,
3134					"Member exceeds struct_size");
3135		return -EINVAL;
3136	}
3137
3138	return 0;
3139}
3140
3141static s32 btf_struct_check_meta(struct btf_verifier_env *env,
3142				 const struct btf_type *t,
3143				 u32 meta_left)
3144{
3145	bool is_union = BTF_INFO_KIND(t->info) == BTF_KIND_UNION;
3146	const struct btf_member *member;
3147	u32 meta_needed, last_offset;
3148	struct btf *btf = env->btf;
3149	u32 struct_size = t->size;
3150	u32 offset;
3151	u16 i;
3152
3153	meta_needed = btf_type_vlen(t) * sizeof(*member);
3154	if (meta_left < meta_needed) {
3155		btf_verifier_log_basic(env, t,
3156				       "meta_left:%u meta_needed:%u",
3157				       meta_left, meta_needed);
3158		return -EINVAL;
3159	}
3160
3161	/* struct type either no name or a valid one */
3162	if (t->name_off &&
3163	    !btf_name_valid_identifier(env->btf, t->name_off)) {
3164		btf_verifier_log_type(env, t, "Invalid name");
3165		return -EINVAL;
3166	}
3167
3168	btf_verifier_log_type(env, t, NULL);
3169
3170	last_offset = 0;
3171	for_each_member(i, t, member) {
3172		if (!btf_name_offset_valid(btf, member->name_off)) {
3173			btf_verifier_log_member(env, t, member,
3174						"Invalid member name_offset:%u",
3175						member->name_off);
3176			return -EINVAL;
3177		}
3178
3179		/* struct member either no name or a valid one */
3180		if (member->name_off &&
3181		    !btf_name_valid_identifier(btf, member->name_off)) {
3182			btf_verifier_log_member(env, t, member, "Invalid name");
3183			return -EINVAL;
3184		}
3185		/* A member cannot be in type void */
3186		if (!member->type || !BTF_TYPE_ID_VALID(member->type)) {
3187			btf_verifier_log_member(env, t, member,
3188						"Invalid type_id");
3189			return -EINVAL;
3190		}
3191
3192		offset = __btf_member_bit_offset(t, member);
3193		if (is_union && offset) {
3194			btf_verifier_log_member(env, t, member,
3195						"Invalid member bits_offset");
3196			return -EINVAL;
3197		}
3198
3199		/*
3200		 * ">" instead of ">=" because the last member could be
3201		 * "char a[0];"
3202		 */
3203		if (last_offset > offset) {
3204			btf_verifier_log_member(env, t, member,
3205						"Invalid member bits_offset");
3206			return -EINVAL;
3207		}
3208
3209		if (BITS_ROUNDUP_BYTES(offset) > struct_size) {
3210			btf_verifier_log_member(env, t, member,
3211						"Member bits_offset exceeds its struct size");
3212			return -EINVAL;
3213		}
3214
3215		btf_verifier_log_member(env, t, member, NULL);
3216		last_offset = offset;
3217	}
3218
3219	return meta_needed;
3220}
3221
3222static int btf_struct_resolve(struct btf_verifier_env *env,
3223			      const struct resolve_vertex *v)
3224{
3225	const struct btf_member *member;
3226	int err;
3227	u16 i;
3228
3229	/* Before continue resolving the next_member,
3230	 * ensure the last member is indeed resolved to a
3231	 * type with size info.
3232	 */
3233	if (v->next_member) {
3234		const struct btf_type *last_member_type;
3235		const struct btf_member *last_member;
3236		u32 last_member_type_id;
3237
3238		last_member = btf_type_member(v->t) + v->next_member - 1;
3239		last_member_type_id = last_member->type;
3240		if (WARN_ON_ONCE(!env_type_is_resolved(env,
3241						       last_member_type_id)))
3242			return -EINVAL;
3243
3244		last_member_type = btf_type_by_id(env->btf,
3245						  last_member_type_id);
3246		if (btf_type_kflag(v->t))
3247			err = btf_type_ops(last_member_type)->check_kflag_member(env, v->t,
3248								last_member,
3249								last_member_type);
3250		else
3251			err = btf_type_ops(last_member_type)->check_member(env, v->t,
3252								last_member,
3253								last_member_type);
3254		if (err)
3255			return err;
3256	}
3257
3258	for_each_member_from(i, v->next_member, v->t, member) {
3259		u32 member_type_id = member->type;
3260		const struct btf_type *member_type = btf_type_by_id(env->btf,
3261								member_type_id);
3262
3263		if (btf_type_nosize_or_null(member_type) ||
3264		    btf_type_is_resolve_source_only(member_type)) {
3265			btf_verifier_log_member(env, v->t, member,
3266						"Invalid member");
3267			return -EINVAL;
3268		}
3269
3270		if (!env_type_is_resolve_sink(env, member_type) &&
3271		    !env_type_is_resolved(env, member_type_id)) {
3272			env_stack_set_next_member(env, i + 1);
3273			return env_stack_push(env, member_type, member_type_id);
3274		}
3275
3276		if (btf_type_kflag(v->t))
3277			err = btf_type_ops(member_type)->check_kflag_member(env, v->t,
3278									    member,
3279									    member_type);
3280		else
3281			err = btf_type_ops(member_type)->check_member(env, v->t,
3282								      member,
3283								      member_type);
3284		if (err)
3285			return err;
3286	}
3287
3288	env_stack_pop_resolved(env, 0, 0);
3289
3290	return 0;
3291}
3292
3293static void btf_struct_log(struct btf_verifier_env *env,
3294			   const struct btf_type *t)
3295{
3296	btf_verifier_log(env, "size=%u vlen=%u", t->size, btf_type_vlen(t));
3297}
3298
 
 
 
 
 
 
3299enum {
3300	BTF_FIELD_IGNORE = 0,
3301	BTF_FIELD_FOUND  = 1,
3302};
3303
3304struct btf_field_info {
3305	enum btf_field_type type;
3306	u32 off;
3307	union {
3308		struct {
3309			u32 type_id;
3310		} kptr;
3311		struct {
3312			const char *node_name;
3313			u32 value_btf_id;
3314		} graph_root;
3315	};
3316};
3317
3318static int btf_find_struct(const struct btf *btf, const struct btf_type *t,
3319			   u32 off, int sz, enum btf_field_type field_type,
3320			   struct btf_field_info *info)
3321{
3322	if (!__btf_type_is_struct(t))
3323		return BTF_FIELD_IGNORE;
3324	if (t->size != sz)
3325		return BTF_FIELD_IGNORE;
3326	info->type = field_type;
3327	info->off = off;
3328	return BTF_FIELD_FOUND;
3329}
3330
3331static int btf_find_kptr(const struct btf *btf, const struct btf_type *t,
3332			 u32 off, int sz, struct btf_field_info *info, u32 field_mask)
3333{
3334	enum btf_field_type type;
3335	u32 res_id;
3336
3337	/* Permit modifiers on the pointer itself */
3338	if (btf_type_is_volatile(t))
3339		t = btf_type_by_id(btf, t->type);
3340	/* For PTR, sz is always == 8 */
3341	if (!btf_type_is_ptr(t))
3342		return BTF_FIELD_IGNORE;
3343	t = btf_type_by_id(btf, t->type);
3344
3345	if (!btf_type_is_type_tag(t))
3346		return BTF_FIELD_IGNORE;
3347	/* Reject extra tags */
3348	if (btf_type_is_type_tag(btf_type_by_id(btf, t->type)))
3349		return -EINVAL;
3350	if (!strcmp("kptr_untrusted", __btf_name_by_offset(btf, t->name_off)))
3351		type = BPF_KPTR_UNREF;
3352	else if (!strcmp("kptr", __btf_name_by_offset(btf, t->name_off)))
3353		type = BPF_KPTR_REF;
3354	else if (!strcmp("percpu_kptr", __btf_name_by_offset(btf, t->name_off)))
3355		type = BPF_KPTR_PERCPU;
3356	else if (!strcmp("uptr", __btf_name_by_offset(btf, t->name_off)))
3357		type = BPF_UPTR;
3358	else
3359		return -EINVAL;
3360
3361	if (!(type & field_mask))
3362		return BTF_FIELD_IGNORE;
3363
3364	/* Get the base type */
3365	t = btf_type_skip_modifiers(btf, t->type, &res_id);
3366	/* Only pointer to struct is allowed */
3367	if (!__btf_type_is_struct(t))
3368		return -EINVAL;
3369
3370	info->type = type;
3371	info->off = off;
3372	info->kptr.type_id = res_id;
3373	return BTF_FIELD_FOUND;
3374}
3375
3376int btf_find_next_decl_tag(const struct btf *btf, const struct btf_type *pt,
3377			   int comp_idx, const char *tag_key, int last_id)
 
3378{
3379	int len = strlen(tag_key);
3380	int i, n;
3381
3382	for (i = last_id + 1, n = btf_nr_types(btf); i < n; i++) {
3383		const struct btf_type *t = btf_type_by_id(btf, i);
 
3384
3385		if (!btf_type_is_decl_tag(t))
3386			continue;
3387		if (pt != btf_type_by_id(btf, t->type))
3388			continue;
3389		if (btf_type_decl_tag(t)->component_idx != comp_idx)
3390			continue;
3391		if (strncmp(__btf_name_by_offset(btf, t->name_off), tag_key, len))
3392			continue;
3393		return i;
3394	}
3395	return -ENOENT;
3396}
3397
3398const char *btf_find_decl_tag_value(const struct btf *btf, const struct btf_type *pt,
3399				    int comp_idx, const char *tag_key)
 
3400{
3401	const char *value = NULL;
3402	const struct btf_type *t;
3403	int len, id;
3404
3405	id = btf_find_next_decl_tag(btf, pt, comp_idx, tag_key, 0);
3406	if (id < 0)
3407		return ERR_PTR(id);
3408
3409	t = btf_type_by_id(btf, id);
3410	len = strlen(tag_key);
3411	value = __btf_name_by_offset(btf, t->name_off) + len;
3412
3413	/* Prevent duplicate entries for same type */
3414	id = btf_find_next_decl_tag(btf, pt, comp_idx, tag_key, id);
3415	if (id >= 0)
3416		return ERR_PTR(-EEXIST);
3417
3418	return value;
3419}
3420
3421static int
3422btf_find_graph_root(const struct btf *btf, const struct btf_type *pt,
3423		    const struct btf_type *t, int comp_idx, u32 off,
3424		    int sz, struct btf_field_info *info,
3425		    enum btf_field_type head_type)
3426{
3427	const char *node_field_name;
3428	const char *value_type;
 
3429	s32 id;
3430
3431	if (!__btf_type_is_struct(t))
3432		return BTF_FIELD_IGNORE;
3433	if (t->size != sz)
3434		return BTF_FIELD_IGNORE;
3435	value_type = btf_find_decl_tag_value(btf, pt, comp_idx, "contains:");
3436	if (IS_ERR(value_type))
3437		return -EINVAL;
3438	node_field_name = strstr(value_type, ":");
3439	if (!node_field_name)
3440		return -EINVAL;
3441	value_type = kstrndup(value_type, node_field_name - value_type, GFP_KERNEL | __GFP_NOWARN);
3442	if (!value_type)
3443		return -ENOMEM;
3444	id = btf_find_by_name_kind(btf, value_type, BTF_KIND_STRUCT);
3445	kfree(value_type);
3446	if (id < 0)
3447		return id;
3448	node_field_name++;
3449	if (str_is_empty(node_field_name))
3450		return -EINVAL;
3451	info->type = head_type;
3452	info->off = off;
3453	info->graph_root.value_btf_id = id;
3454	info->graph_root.node_name = node_field_name;
3455	return BTF_FIELD_FOUND;
3456}
3457
3458#define field_mask_test_name(field_type, field_type_str) \
3459	if (field_mask & field_type && !strcmp(name, field_type_str)) { \
3460		type = field_type;					\
3461		goto end;						\
3462	}
3463
3464static int btf_get_field_type(const struct btf *btf, const struct btf_type *var_type,
3465			      u32 field_mask, u32 *seen_mask,
3466			      int *align, int *sz)
3467{
3468	int type = 0;
3469	const char *name = __btf_name_by_offset(btf, var_type->name_off);
3470
3471	if (field_mask & BPF_SPIN_LOCK) {
3472		if (!strcmp(name, "bpf_spin_lock")) {
3473			if (*seen_mask & BPF_SPIN_LOCK)
3474				return -E2BIG;
3475			*seen_mask |= BPF_SPIN_LOCK;
3476			type = BPF_SPIN_LOCK;
3477			goto end;
3478		}
3479	}
3480	if (field_mask & BPF_TIMER) {
3481		if (!strcmp(name, "bpf_timer")) {
3482			if (*seen_mask & BPF_TIMER)
3483				return -E2BIG;
3484			*seen_mask |= BPF_TIMER;
3485			type = BPF_TIMER;
3486			goto end;
3487		}
3488	}
3489	if (field_mask & BPF_WORKQUEUE) {
3490		if (!strcmp(name, "bpf_wq")) {
3491			if (*seen_mask & BPF_WORKQUEUE)
3492				return -E2BIG;
3493			*seen_mask |= BPF_WORKQUEUE;
3494			type = BPF_WORKQUEUE;
 
 
 
3495			goto end;
3496		}
3497	}
3498	field_mask_test_name(BPF_LIST_HEAD, "bpf_list_head");
3499	field_mask_test_name(BPF_LIST_NODE, "bpf_list_node");
3500	field_mask_test_name(BPF_RB_ROOT,   "bpf_rb_root");
3501	field_mask_test_name(BPF_RB_NODE,   "bpf_rb_node");
3502	field_mask_test_name(BPF_REFCOUNT,  "bpf_refcount");
3503
3504	/* Only return BPF_KPTR when all other types with matchable names fail */
3505	if (field_mask & (BPF_KPTR | BPF_UPTR) && !__btf_type_is_struct(var_type)) {
3506		type = BPF_KPTR_REF;
3507		goto end;
3508	}
3509	return 0;
3510end:
3511	*sz = btf_field_type_size(type);
3512	*align = btf_field_type_align(type);
3513	return type;
3514}
3515
3516#undef field_mask_test_name
3517
3518/* Repeat a number of fields for a specified number of times.
3519 *
3520 * Copy the fields starting from the first field and repeat them for
3521 * repeat_cnt times. The fields are repeated by adding the offset of each
3522 * field with
3523 *   (i + 1) * elem_size
3524 * where i is the repeat index and elem_size is the size of an element.
3525 */
3526static int btf_repeat_fields(struct btf_field_info *info, int info_cnt,
3527			     u32 field_cnt, u32 repeat_cnt, u32 elem_size)
3528{
3529	u32 i, j;
3530	u32 cur;
3531
3532	/* Ensure not repeating fields that should not be repeated. */
3533	for (i = 0; i < field_cnt; i++) {
3534		switch (info[i].type) {
3535		case BPF_KPTR_UNREF:
3536		case BPF_KPTR_REF:
3537		case BPF_KPTR_PERCPU:
3538		case BPF_UPTR:
3539		case BPF_LIST_HEAD:
3540		case BPF_RB_ROOT:
3541			break;
3542		default:
3543			return -EINVAL;
3544		}
3545	}
3546
3547	/* The type of struct size or variable size is u32,
3548	 * so the multiplication will not overflow.
3549	 */
3550	if (field_cnt * (repeat_cnt + 1) > info_cnt)
3551		return -E2BIG;
3552
3553	cur = field_cnt;
3554	for (i = 0; i < repeat_cnt; i++) {
3555		memcpy(&info[cur], &info[0], field_cnt * sizeof(info[0]));
3556		for (j = 0; j < field_cnt; j++)
3557			info[cur++].off += (i + 1) * elem_size;
3558	}
3559
3560	return 0;
3561}
3562
3563static int btf_find_struct_field(const struct btf *btf,
3564				 const struct btf_type *t, u32 field_mask,
3565				 struct btf_field_info *info, int info_cnt,
3566				 u32 level);
3567
3568/* Find special fields in the struct type of a field.
3569 *
3570 * This function is used to find fields of special types that is not a
3571 * global variable or a direct field of a struct type. It also handles the
3572 * repetition if it is the element type of an array.
3573 */
3574static int btf_find_nested_struct(const struct btf *btf, const struct btf_type *t,
3575				  u32 off, u32 nelems,
3576				  u32 field_mask, struct btf_field_info *info,
3577				  int info_cnt, u32 level)
3578{
3579	int ret, err, i;
3580
3581	level++;
3582	if (level >= MAX_RESOLVE_DEPTH)
3583		return -E2BIG;
3584
3585	ret = btf_find_struct_field(btf, t, field_mask, info, info_cnt, level);
3586
3587	if (ret <= 0)
3588		return ret;
3589
3590	/* Shift the offsets of the nested struct fields to the offsets
3591	 * related to the container.
3592	 */
3593	for (i = 0; i < ret; i++)
3594		info[i].off += off;
3595
3596	if (nelems > 1) {
3597		err = btf_repeat_fields(info, info_cnt, ret, nelems - 1, t->size);
3598		if (err == 0)
3599			ret *= nelems;
3600		else
3601			ret = err;
3602	}
3603
3604	return ret;
3605}
3606
3607static int btf_find_field_one(const struct btf *btf,
3608			      const struct btf_type *var,
3609			      const struct btf_type *var_type,
3610			      int var_idx,
3611			      u32 off, u32 expected_size,
3612			      u32 field_mask, u32 *seen_mask,
3613			      struct btf_field_info *info, int info_cnt,
3614			      u32 level)
3615{
3616	int ret, align, sz, field_type;
3617	struct btf_field_info tmp;
3618	const struct btf_array *array;
3619	u32 i, nelems = 1;
3620
3621	/* Walk into array types to find the element type and the number of
3622	 * elements in the (flattened) array.
3623	 */
3624	for (i = 0; i < MAX_RESOLVE_DEPTH && btf_type_is_array(var_type); i++) {
3625		array = btf_array(var_type);
3626		nelems *= array->nelems;
3627		var_type = btf_type_by_id(btf, array->type);
3628	}
3629	if (i == MAX_RESOLVE_DEPTH)
3630		return -E2BIG;
3631	if (nelems == 0)
3632		return 0;
3633
3634	field_type = btf_get_field_type(btf, var_type,
3635					field_mask, seen_mask, &align, &sz);
3636	/* Look into variables of struct types */
3637	if (!field_type && __btf_type_is_struct(var_type)) {
3638		sz = var_type->size;
3639		if (expected_size && expected_size != sz * nelems)
3640			return 0;
3641		ret = btf_find_nested_struct(btf, var_type, off, nelems, field_mask,
3642					     &info[0], info_cnt, level);
3643		return ret;
3644	}
3645
3646	if (field_type == 0)
3647		return 0;
3648	if (field_type < 0)
3649		return field_type;
3650
3651	if (expected_size && expected_size != sz * nelems)
3652		return 0;
3653	if (off % align)
3654		return 0;
3655
3656	switch (field_type) {
3657	case BPF_SPIN_LOCK:
3658	case BPF_TIMER:
3659	case BPF_WORKQUEUE:
3660	case BPF_LIST_NODE:
3661	case BPF_RB_NODE:
3662	case BPF_REFCOUNT:
3663		ret = btf_find_struct(btf, var_type, off, sz, field_type,
3664				      info_cnt ? &info[0] : &tmp);
3665		if (ret < 0)
3666			return ret;
3667		break;
3668	case BPF_KPTR_UNREF:
3669	case BPF_KPTR_REF:
3670	case BPF_KPTR_PERCPU:
3671	case BPF_UPTR:
3672		ret = btf_find_kptr(btf, var_type, off, sz,
3673				    info_cnt ? &info[0] : &tmp, field_mask);
3674		if (ret < 0)
3675			return ret;
3676		break;
3677	case BPF_LIST_HEAD:
3678	case BPF_RB_ROOT:
3679		ret = btf_find_graph_root(btf, var, var_type,
3680					  var_idx, off, sz,
3681					  info_cnt ? &info[0] : &tmp,
3682					  field_type);
3683		if (ret < 0)
3684			return ret;
3685		break;
3686	default:
3687		return -EFAULT;
3688	}
3689
3690	if (ret == BTF_FIELD_IGNORE)
3691		return 0;
3692	if (!info_cnt)
3693		return -E2BIG;
3694	if (nelems > 1) {
3695		ret = btf_repeat_fields(info, info_cnt, 1, nelems - 1, sz);
3696		if (ret < 0)
3697			return ret;
3698	}
3699	return nelems;
3700}
3701
3702static int btf_find_struct_field(const struct btf *btf,
3703				 const struct btf_type *t, u32 field_mask,
3704				 struct btf_field_info *info, int info_cnt,
3705				 u32 level)
3706{
3707	int ret, idx = 0;
3708	const struct btf_member *member;
3709	u32 i, off, seen_mask = 0;
3710
3711	for_each_member(i, t, member) {
3712		const struct btf_type *member_type = btf_type_by_id(btf,
3713								    member->type);
3714
 
 
 
 
 
 
 
3715		off = __btf_member_bit_offset(t, member);
3716		if (off % 8)
3717			/* valid C code cannot generate such BTF */
3718			return -EINVAL;
3719		off /= 8;
 
 
3720
3721		ret = btf_find_field_one(btf, t, member_type, i,
3722					 off, 0,
3723					 field_mask, &seen_mask,
3724					 &info[idx], info_cnt - idx, level);
3725		if (ret < 0)
3726			return ret;
3727		idx += ret;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
3728	}
3729	return idx;
3730}
3731
3732static int btf_find_datasec_var(const struct btf *btf, const struct btf_type *t,
3733				u32 field_mask, struct btf_field_info *info,
3734				int info_cnt, u32 level)
3735{
3736	int ret, idx = 0;
3737	const struct btf_var_secinfo *vsi;
 
3738	u32 i, off, seen_mask = 0;
3739
3740	for_each_vsi(i, t, vsi) {
3741		const struct btf_type *var = btf_type_by_id(btf, vsi->type);
3742		const struct btf_type *var_type = btf_type_by_id(btf, var->type);
3743
 
 
 
 
 
 
 
3744		off = vsi->offset;
3745		ret = btf_find_field_one(btf, var, var_type, -1, off, vsi->size,
3746					 field_mask, &seen_mask,
3747					 &info[idx], info_cnt - idx,
3748					 level);
3749		if (ret < 0)
3750			return ret;
3751		idx += ret;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
3752	}
3753	return idx;
3754}
3755
3756static int btf_find_field(const struct btf *btf, const struct btf_type *t,
3757			  u32 field_mask, struct btf_field_info *info,
3758			  int info_cnt)
3759{
3760	if (__btf_type_is_struct(t))
3761		return btf_find_struct_field(btf, t, field_mask, info, info_cnt, 0);
3762	else if (btf_type_is_datasec(t))
3763		return btf_find_datasec_var(btf, t, field_mask, info, info_cnt, 0);
3764	return -EINVAL;
3765}
3766
3767/* Callers have to ensure the life cycle of btf if it is program BTF */
3768static int btf_parse_kptr(const struct btf *btf, struct btf_field *field,
3769			  struct btf_field_info *info)
3770{
3771	struct module *mod = NULL;
3772	const struct btf_type *t;
3773	/* If a matching btf type is found in kernel or module BTFs, kptr_ref
3774	 * is that BTF, otherwise it's program BTF
3775	 */
3776	struct btf *kptr_btf;
3777	int ret;
3778	s32 id;
3779
3780	/* Find type in map BTF, and use it to look up the matching type
3781	 * in vmlinux or module BTFs, by name and kind.
3782	 */
3783	t = btf_type_by_id(btf, info->kptr.type_id);
3784	id = bpf_find_btf_id(__btf_name_by_offset(btf, t->name_off), BTF_INFO_KIND(t->info),
3785			     &kptr_btf);
3786	if (id == -ENOENT) {
3787		/* btf_parse_kptr should only be called w/ btf = program BTF */
3788		WARN_ON_ONCE(btf_is_kernel(btf));
3789
3790		/* Type exists only in program BTF. Assume that it's a MEM_ALLOC
3791		 * kptr allocated via bpf_obj_new
3792		 */
3793		field->kptr.dtor = NULL;
3794		id = info->kptr.type_id;
3795		kptr_btf = (struct btf *)btf;
3796		goto found_dtor;
3797	}
3798	if (id < 0)
3799		return id;
3800
3801	/* Find and stash the function pointer for the destruction function that
3802	 * needs to be eventually invoked from the map free path.
3803	 */
3804	if (info->type == BPF_KPTR_REF) {
3805		const struct btf_type *dtor_func;
3806		const char *dtor_func_name;
3807		unsigned long addr;
3808		s32 dtor_btf_id;
3809
3810		/* This call also serves as a whitelist of allowed objects that
3811		 * can be used as a referenced pointer and be stored in a map at
3812		 * the same time.
3813		 */
3814		dtor_btf_id = btf_find_dtor_kfunc(kptr_btf, id);
3815		if (dtor_btf_id < 0) {
3816			ret = dtor_btf_id;
3817			goto end_btf;
3818		}
3819
3820		dtor_func = btf_type_by_id(kptr_btf, dtor_btf_id);
3821		if (!dtor_func) {
3822			ret = -ENOENT;
3823			goto end_btf;
3824		}
3825
3826		if (btf_is_module(kptr_btf)) {
3827			mod = btf_try_get_module(kptr_btf);
3828			if (!mod) {
3829				ret = -ENXIO;
3830				goto end_btf;
3831			}
3832		}
3833
3834		/* We already verified dtor_func to be btf_type_is_func
3835		 * in register_btf_id_dtor_kfuncs.
3836		 */
3837		dtor_func_name = __btf_name_by_offset(kptr_btf, dtor_func->name_off);
3838		addr = kallsyms_lookup_name(dtor_func_name);
3839		if (!addr) {
3840			ret = -EINVAL;
3841			goto end_mod;
3842		}
3843		field->kptr.dtor = (void *)addr;
3844	}
3845
3846found_dtor:
3847	field->kptr.btf_id = id;
3848	field->kptr.btf = kptr_btf;
3849	field->kptr.module = mod;
3850	return 0;
3851end_mod:
3852	module_put(mod);
3853end_btf:
3854	btf_put(kptr_btf);
3855	return ret;
3856}
3857
3858static int btf_parse_graph_root(const struct btf *btf,
3859				struct btf_field *field,
3860				struct btf_field_info *info,
3861				const char *node_type_name,
3862				size_t node_type_align)
3863{
3864	const struct btf_type *t, *n = NULL;
3865	const struct btf_member *member;
3866	u32 offset;
3867	int i;
3868
3869	t = btf_type_by_id(btf, info->graph_root.value_btf_id);
3870	/* We've already checked that value_btf_id is a struct type. We
3871	 * just need to figure out the offset of the list_node, and
3872	 * verify its type.
3873	 */
3874	for_each_member(i, t, member) {
3875		if (strcmp(info->graph_root.node_name,
3876			   __btf_name_by_offset(btf, member->name_off)))
3877			continue;
3878		/* Invalid BTF, two members with same name */
3879		if (n)
3880			return -EINVAL;
3881		n = btf_type_by_id(btf, member->type);
3882		if (!__btf_type_is_struct(n))
3883			return -EINVAL;
3884		if (strcmp(node_type_name, __btf_name_by_offset(btf, n->name_off)))
3885			return -EINVAL;
3886		offset = __btf_member_bit_offset(n, member);
3887		if (offset % 8)
3888			return -EINVAL;
3889		offset /= 8;
3890		if (offset % node_type_align)
3891			return -EINVAL;
3892
3893		field->graph_root.btf = (struct btf *)btf;
3894		field->graph_root.value_btf_id = info->graph_root.value_btf_id;
3895		field->graph_root.node_offset = offset;
3896	}
3897	if (!n)
3898		return -ENOENT;
3899	return 0;
3900}
3901
3902static int btf_parse_list_head(const struct btf *btf, struct btf_field *field,
3903			       struct btf_field_info *info)
3904{
3905	return btf_parse_graph_root(btf, field, info, "bpf_list_node",
3906					    __alignof__(struct bpf_list_node));
3907}
3908
3909static int btf_parse_rb_root(const struct btf *btf, struct btf_field *field,
3910			     struct btf_field_info *info)
3911{
3912	return btf_parse_graph_root(btf, field, info, "bpf_rb_node",
3913					    __alignof__(struct bpf_rb_node));
3914}
3915
3916static int btf_field_cmp(const void *_a, const void *_b, const void *priv)
3917{
3918	const struct btf_field *a = (const struct btf_field *)_a;
3919	const struct btf_field *b = (const struct btf_field *)_b;
3920
3921	if (a->offset < b->offset)
3922		return -1;
3923	else if (a->offset > b->offset)
3924		return 1;
3925	return 0;
3926}
3927
3928struct btf_record *btf_parse_fields(const struct btf *btf, const struct btf_type *t,
3929				    u32 field_mask, u32 value_size)
3930{
3931	struct btf_field_info info_arr[BTF_FIELDS_MAX];
3932	u32 next_off = 0, field_type_size;
3933	struct btf_record *rec;
 
3934	int ret, i, cnt;
3935
3936	ret = btf_find_field(btf, t, field_mask, info_arr, ARRAY_SIZE(info_arr));
3937	if (ret < 0)
3938		return ERR_PTR(ret);
3939	if (!ret)
3940		return NULL;
3941
3942	cnt = ret;
3943	/* This needs to be kzalloc to zero out padding and unused fields, see
3944	 * comment in btf_record_equal.
3945	 */
3946	rec = kzalloc(offsetof(struct btf_record, fields[cnt]), GFP_KERNEL | __GFP_NOWARN);
3947	if (!rec)
3948		return ERR_PTR(-ENOMEM);
3949
3950	rec->spin_lock_off = -EINVAL;
3951	rec->timer_off = -EINVAL;
3952	rec->wq_off = -EINVAL;
3953	rec->refcount_off = -EINVAL;
3954	for (i = 0; i < cnt; i++) {
3955		field_type_size = btf_field_type_size(info_arr[i].type);
3956		if (info_arr[i].off + field_type_size > value_size) {
3957			WARN_ONCE(1, "verifier bug off %d size %d", info_arr[i].off, value_size);
3958			ret = -EFAULT;
3959			goto end;
3960		}
3961		if (info_arr[i].off < next_off) {
3962			ret = -EEXIST;
3963			goto end;
3964		}
3965		next_off = info_arr[i].off + field_type_size;
3966
3967		rec->field_mask |= info_arr[i].type;
3968		rec->fields[i].offset = info_arr[i].off;
3969		rec->fields[i].type = info_arr[i].type;
3970		rec->fields[i].size = field_type_size;
3971
3972		switch (info_arr[i].type) {
3973		case BPF_SPIN_LOCK:
3974			WARN_ON_ONCE(rec->spin_lock_off >= 0);
3975			/* Cache offset for faster lookup at runtime */
3976			rec->spin_lock_off = rec->fields[i].offset;
3977			break;
3978		case BPF_TIMER:
3979			WARN_ON_ONCE(rec->timer_off >= 0);
3980			/* Cache offset for faster lookup at runtime */
3981			rec->timer_off = rec->fields[i].offset;
3982			break;
3983		case BPF_WORKQUEUE:
3984			WARN_ON_ONCE(rec->wq_off >= 0);
3985			/* Cache offset for faster lookup at runtime */
3986			rec->wq_off = rec->fields[i].offset;
3987			break;
3988		case BPF_REFCOUNT:
3989			WARN_ON_ONCE(rec->refcount_off >= 0);
3990			/* Cache offset for faster lookup at runtime */
3991			rec->refcount_off = rec->fields[i].offset;
3992			break;
3993		case BPF_KPTR_UNREF:
3994		case BPF_KPTR_REF:
3995		case BPF_KPTR_PERCPU:
3996		case BPF_UPTR:
3997			ret = btf_parse_kptr(btf, &rec->fields[i], &info_arr[i]);
3998			if (ret < 0)
3999				goto end;
4000			break;
4001		case BPF_LIST_HEAD:
4002			ret = btf_parse_list_head(btf, &rec->fields[i], &info_arr[i]);
4003			if (ret < 0)
4004				goto end;
4005			break;
4006		case BPF_RB_ROOT:
4007			ret = btf_parse_rb_root(btf, &rec->fields[i], &info_arr[i]);
4008			if (ret < 0)
4009				goto end;
4010			break;
4011		case BPF_LIST_NODE:
4012		case BPF_RB_NODE:
4013			break;
4014		default:
4015			ret = -EFAULT;
4016			goto end;
4017		}
4018		rec->cnt++;
4019	}
4020
4021	/* bpf_{list_head, rb_node} require bpf_spin_lock */
4022	if ((btf_record_has_field(rec, BPF_LIST_HEAD) ||
4023	     btf_record_has_field(rec, BPF_RB_ROOT)) && rec->spin_lock_off < 0) {
4024		ret = -EINVAL;
4025		goto end;
4026	}
4027
4028	if (rec->refcount_off < 0 &&
4029	    btf_record_has_field(rec, BPF_LIST_NODE) &&
4030	    btf_record_has_field(rec, BPF_RB_NODE)) {
4031		ret = -EINVAL;
4032		goto end;
4033	}
4034
4035	sort_r(rec->fields, rec->cnt, sizeof(struct btf_field), btf_field_cmp,
4036	       NULL, rec);
4037
4038	return rec;
4039end:
4040	btf_record_free(rec);
4041	return ERR_PTR(ret);
4042}
4043
4044int btf_check_and_fixup_fields(const struct btf *btf, struct btf_record *rec)
4045{
4046	int i;
4047
4048	/* There are three types that signify ownership of some other type:
4049	 *  kptr_ref, bpf_list_head, bpf_rb_root.
4050	 * kptr_ref only supports storing kernel types, which can't store
4051	 * references to program allocated local types.
4052	 *
4053	 * Hence we only need to ensure that bpf_{list_head,rb_root} ownership
4054	 * does not form cycles.
4055	 */
4056	if (IS_ERR_OR_NULL(rec) || !(rec->field_mask & (BPF_GRAPH_ROOT | BPF_UPTR)))
4057		return 0;
4058	for (i = 0; i < rec->cnt; i++) {
4059		struct btf_struct_meta *meta;
4060		const struct btf_type *t;
4061		u32 btf_id;
4062
4063		if (rec->fields[i].type == BPF_UPTR) {
4064			/* The uptr only supports pinning one page and cannot
4065			 * point to a kernel struct
4066			 */
4067			if (btf_is_kernel(rec->fields[i].kptr.btf))
4068				return -EINVAL;
4069			t = btf_type_by_id(rec->fields[i].kptr.btf,
4070					   rec->fields[i].kptr.btf_id);
4071			if (!t->size)
4072				return -EINVAL;
4073			if (t->size > PAGE_SIZE)
4074				return -E2BIG;
4075			continue;
4076		}
4077
4078		if (!(rec->fields[i].type & BPF_GRAPH_ROOT))
4079			continue;
4080		btf_id = rec->fields[i].graph_root.value_btf_id;
4081		meta = btf_find_struct_meta(btf, btf_id);
4082		if (!meta)
4083			return -EFAULT;
4084		rec->fields[i].graph_root.value_rec = meta->record;
4085
4086		/* We need to set value_rec for all root types, but no need
4087		 * to check ownership cycle for a type unless it's also a
4088		 * node type.
4089		 */
4090		if (!(rec->field_mask & BPF_GRAPH_NODE))
4091			continue;
4092
4093		/* We need to ensure ownership acyclicity among all types. The
4094		 * proper way to do it would be to topologically sort all BTF
4095		 * IDs based on the ownership edges, since there can be multiple
4096		 * bpf_{list_head,rb_node} in a type. Instead, we use the
4097		 * following resaoning:
4098		 *
4099		 * - A type can only be owned by another type in user BTF if it
4100		 *   has a bpf_{list,rb}_node. Let's call these node types.
4101		 * - A type can only _own_ another type in user BTF if it has a
4102		 *   bpf_{list_head,rb_root}. Let's call these root types.
4103		 *
4104		 * We ensure that if a type is both a root and node, its
4105		 * element types cannot be root types.
4106		 *
4107		 * To ensure acyclicity:
4108		 *
4109		 * When A is an root type but not a node, its ownership
4110		 * chain can be:
4111		 *	A -> B -> C
4112		 * Where:
4113		 * - A is an root, e.g. has bpf_rb_root.
4114		 * - B is both a root and node, e.g. has bpf_rb_node and
4115		 *   bpf_list_head.
4116		 * - C is only an root, e.g. has bpf_list_node
4117		 *
4118		 * When A is both a root and node, some other type already
4119		 * owns it in the BTF domain, hence it can not own
4120		 * another root type through any of the ownership edges.
4121		 *	A -> B
4122		 * Where:
4123		 * - A is both an root and node.
4124		 * - B is only an node.
4125		 */
4126		if (meta->record->field_mask & BPF_GRAPH_ROOT)
4127			return -ELOOP;
4128	}
4129	return 0;
4130}
4131
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
4132static void __btf_struct_show(const struct btf *btf, const struct btf_type *t,
4133			      u32 type_id, void *data, u8 bits_offset,
4134			      struct btf_show *show)
4135{
4136	const struct btf_member *member;
4137	void *safe_data;
4138	u32 i;
4139
4140	safe_data = btf_show_start_struct_type(show, t, type_id, data);
4141	if (!safe_data)
4142		return;
4143
4144	for_each_member(i, t, member) {
4145		const struct btf_type *member_type = btf_type_by_id(btf,
4146								member->type);
4147		const struct btf_kind_operations *ops;
4148		u32 member_offset, bitfield_size;
4149		u32 bytes_offset;
4150		u8 bits8_offset;
4151
4152		btf_show_start_member(show, member);
4153
4154		member_offset = __btf_member_bit_offset(t, member);
4155		bitfield_size = __btf_member_bitfield_size(t, member);
4156		bytes_offset = BITS_ROUNDDOWN_BYTES(member_offset);
4157		bits8_offset = BITS_PER_BYTE_MASKED(member_offset);
4158		if (bitfield_size) {
4159			safe_data = btf_show_start_type(show, member_type,
4160							member->type,
4161							data + bytes_offset);
4162			if (safe_data)
4163				btf_bitfield_show(safe_data,
4164						  bits8_offset,
4165						  bitfield_size, show);
4166			btf_show_end_type(show);
4167		} else {
4168			ops = btf_type_ops(member_type);
4169			ops->show(btf, member_type, member->type,
4170				  data + bytes_offset, bits8_offset, show);
4171		}
4172
4173		btf_show_end_member(show);
4174	}
4175
4176	btf_show_end_struct_type(show);
4177}
4178
4179static void btf_struct_show(const struct btf *btf, const struct btf_type *t,
4180			    u32 type_id, void *data, u8 bits_offset,
4181			    struct btf_show *show)
4182{
4183	const struct btf_member *m = show->state.member;
4184
4185	/*
4186	 * First check if any members would be shown (are non-zero).
4187	 * See comments above "struct btf_show" definition for more
4188	 * details on how this works at a high-level.
4189	 */
4190	if (show->state.depth > 0 && !(show->flags & BTF_SHOW_ZERO)) {
4191		if (!show->state.depth_check) {
4192			show->state.depth_check = show->state.depth + 1;
4193			show->state.depth_to_show = 0;
4194		}
4195		__btf_struct_show(btf, t, type_id, data, bits_offset, show);
4196		/* Restore saved member data here */
4197		show->state.member = m;
4198		if (show->state.depth_check != show->state.depth + 1)
4199			return;
4200		show->state.depth_check = 0;
4201
4202		if (show->state.depth_to_show <= show->state.depth)
4203			return;
4204		/*
4205		 * Reaching here indicates we have recursed and found
4206		 * non-zero child values.
4207		 */
4208	}
4209
4210	__btf_struct_show(btf, t, type_id, data, bits_offset, show);
4211}
4212
4213static const struct btf_kind_operations struct_ops = {
4214	.check_meta = btf_struct_check_meta,
4215	.resolve = btf_struct_resolve,
4216	.check_member = btf_struct_check_member,
4217	.check_kflag_member = btf_generic_check_kflag_member,
4218	.log_details = btf_struct_log,
4219	.show = btf_struct_show,
4220};
4221
4222static int btf_enum_check_member(struct btf_verifier_env *env,
4223				 const struct btf_type *struct_type,
4224				 const struct btf_member *member,
4225				 const struct btf_type *member_type)
4226{
4227	u32 struct_bits_off = member->offset;
4228	u32 struct_size, bytes_offset;
4229
4230	if (BITS_PER_BYTE_MASKED(struct_bits_off)) {
4231		btf_verifier_log_member(env, struct_type, member,
4232					"Member is not byte aligned");
4233		return -EINVAL;
4234	}
4235
4236	struct_size = struct_type->size;
4237	bytes_offset = BITS_ROUNDDOWN_BYTES(struct_bits_off);
4238	if (struct_size - bytes_offset < member_type->size) {
4239		btf_verifier_log_member(env, struct_type, member,
4240					"Member exceeds struct_size");
4241		return -EINVAL;
4242	}
4243
4244	return 0;
4245}
4246
4247static int btf_enum_check_kflag_member(struct btf_verifier_env *env,
4248				       const struct btf_type *struct_type,
4249				       const struct btf_member *member,
4250				       const struct btf_type *member_type)
4251{
4252	u32 struct_bits_off, nr_bits, bytes_end, struct_size;
4253	u32 int_bitsize = sizeof(int) * BITS_PER_BYTE;
4254
4255	struct_bits_off = BTF_MEMBER_BIT_OFFSET(member->offset);
4256	nr_bits = BTF_MEMBER_BITFIELD_SIZE(member->offset);
4257	if (!nr_bits) {
4258		if (BITS_PER_BYTE_MASKED(struct_bits_off)) {
4259			btf_verifier_log_member(env, struct_type, member,
4260						"Member is not byte aligned");
4261			return -EINVAL;
4262		}
4263
4264		nr_bits = int_bitsize;
4265	} else if (nr_bits > int_bitsize) {
4266		btf_verifier_log_member(env, struct_type, member,
4267					"Invalid member bitfield_size");
4268		return -EINVAL;
4269	}
4270
4271	struct_size = struct_type->size;
4272	bytes_end = BITS_ROUNDUP_BYTES(struct_bits_off + nr_bits);
4273	if (struct_size < bytes_end) {
4274		btf_verifier_log_member(env, struct_type, member,
4275					"Member exceeds struct_size");
4276		return -EINVAL;
4277	}
4278
4279	return 0;
4280}
4281
4282static s32 btf_enum_check_meta(struct btf_verifier_env *env,
4283			       const struct btf_type *t,
4284			       u32 meta_left)
4285{
4286	const struct btf_enum *enums = btf_type_enum(t);
4287	struct btf *btf = env->btf;
4288	const char *fmt_str;
4289	u16 i, nr_enums;
4290	u32 meta_needed;
4291
4292	nr_enums = btf_type_vlen(t);
4293	meta_needed = nr_enums * sizeof(*enums);
4294
4295	if (meta_left < meta_needed) {
4296		btf_verifier_log_basic(env, t,
4297				       "meta_left:%u meta_needed:%u",
4298				       meta_left, meta_needed);
4299		return -EINVAL;
4300	}
4301
4302	if (t->size > 8 || !is_power_of_2(t->size)) {
4303		btf_verifier_log_type(env, t, "Unexpected size");
4304		return -EINVAL;
4305	}
4306
4307	/* enum type either no name or a valid one */
4308	if (t->name_off &&
4309	    !btf_name_valid_identifier(env->btf, t->name_off)) {
4310		btf_verifier_log_type(env, t, "Invalid name");
4311		return -EINVAL;
4312	}
4313
4314	btf_verifier_log_type(env, t, NULL);
4315
4316	for (i = 0; i < nr_enums; i++) {
4317		if (!btf_name_offset_valid(btf, enums[i].name_off)) {
4318			btf_verifier_log(env, "\tInvalid name_offset:%u",
4319					 enums[i].name_off);
4320			return -EINVAL;
4321		}
4322
4323		/* enum member must have a valid name */
4324		if (!enums[i].name_off ||
4325		    !btf_name_valid_identifier(btf, enums[i].name_off)) {
4326			btf_verifier_log_type(env, t, "Invalid name");
4327			return -EINVAL;
4328		}
4329
4330		if (env->log.level == BPF_LOG_KERNEL)
4331			continue;
4332		fmt_str = btf_type_kflag(t) ? "\t%s val=%d\n" : "\t%s val=%u\n";
4333		btf_verifier_log(env, fmt_str,
4334				 __btf_name_by_offset(btf, enums[i].name_off),
4335				 enums[i].val);
4336	}
4337
4338	return meta_needed;
4339}
4340
4341static void btf_enum_log(struct btf_verifier_env *env,
4342			 const struct btf_type *t)
4343{
4344	btf_verifier_log(env, "size=%u vlen=%u", t->size, btf_type_vlen(t));
4345}
4346
4347static void btf_enum_show(const struct btf *btf, const struct btf_type *t,
4348			  u32 type_id, void *data, u8 bits_offset,
4349			  struct btf_show *show)
4350{
4351	const struct btf_enum *enums = btf_type_enum(t);
4352	u32 i, nr_enums = btf_type_vlen(t);
4353	void *safe_data;
4354	int v;
4355
4356	safe_data = btf_show_start_type(show, t, type_id, data);
4357	if (!safe_data)
4358		return;
4359
4360	v = *(int *)safe_data;
4361
4362	for (i = 0; i < nr_enums; i++) {
4363		if (v != enums[i].val)
4364			continue;
4365
4366		btf_show_type_value(show, "%s",
4367				    __btf_name_by_offset(btf,
4368							 enums[i].name_off));
4369
4370		btf_show_end_type(show);
4371		return;
4372	}
4373
4374	if (btf_type_kflag(t))
4375		btf_show_type_value(show, "%d", v);
4376	else
4377		btf_show_type_value(show, "%u", v);
4378	btf_show_end_type(show);
4379}
4380
4381static const struct btf_kind_operations enum_ops = {
4382	.check_meta = btf_enum_check_meta,
4383	.resolve = btf_df_resolve,
4384	.check_member = btf_enum_check_member,
4385	.check_kflag_member = btf_enum_check_kflag_member,
4386	.log_details = btf_enum_log,
4387	.show = btf_enum_show,
4388};
4389
4390static s32 btf_enum64_check_meta(struct btf_verifier_env *env,
4391				 const struct btf_type *t,
4392				 u32 meta_left)
4393{
4394	const struct btf_enum64 *enums = btf_type_enum64(t);
4395	struct btf *btf = env->btf;
4396	const char *fmt_str;
4397	u16 i, nr_enums;
4398	u32 meta_needed;
4399
4400	nr_enums = btf_type_vlen(t);
4401	meta_needed = nr_enums * sizeof(*enums);
4402
4403	if (meta_left < meta_needed) {
4404		btf_verifier_log_basic(env, t,
4405				       "meta_left:%u meta_needed:%u",
4406				       meta_left, meta_needed);
4407		return -EINVAL;
4408	}
4409
4410	if (t->size > 8 || !is_power_of_2(t->size)) {
4411		btf_verifier_log_type(env, t, "Unexpected size");
4412		return -EINVAL;
4413	}
4414
4415	/* enum type either no name or a valid one */
4416	if (t->name_off &&
4417	    !btf_name_valid_identifier(env->btf, t->name_off)) {
4418		btf_verifier_log_type(env, t, "Invalid name");
4419		return -EINVAL;
4420	}
4421
4422	btf_verifier_log_type(env, t, NULL);
4423
4424	for (i = 0; i < nr_enums; i++) {
4425		if (!btf_name_offset_valid(btf, enums[i].name_off)) {
4426			btf_verifier_log(env, "\tInvalid name_offset:%u",
4427					 enums[i].name_off);
4428			return -EINVAL;
4429		}
4430
4431		/* enum member must have a valid name */
4432		if (!enums[i].name_off ||
4433		    !btf_name_valid_identifier(btf, enums[i].name_off)) {
4434			btf_verifier_log_type(env, t, "Invalid name");
4435			return -EINVAL;
4436		}
4437
4438		if (env->log.level == BPF_LOG_KERNEL)
4439			continue;
4440
4441		fmt_str = btf_type_kflag(t) ? "\t%s val=%lld\n" : "\t%s val=%llu\n";
4442		btf_verifier_log(env, fmt_str,
4443				 __btf_name_by_offset(btf, enums[i].name_off),
4444				 btf_enum64_value(enums + i));
4445	}
4446
4447	return meta_needed;
4448}
4449
4450static void btf_enum64_show(const struct btf *btf, const struct btf_type *t,
4451			    u32 type_id, void *data, u8 bits_offset,
4452			    struct btf_show *show)
4453{
4454	const struct btf_enum64 *enums = btf_type_enum64(t);
4455	u32 i, nr_enums = btf_type_vlen(t);
4456	void *safe_data;
4457	s64 v;
4458
4459	safe_data = btf_show_start_type(show, t, type_id, data);
4460	if (!safe_data)
4461		return;
4462
4463	v = *(u64 *)safe_data;
4464
4465	for (i = 0; i < nr_enums; i++) {
4466		if (v != btf_enum64_value(enums + i))
4467			continue;
4468
4469		btf_show_type_value(show, "%s",
4470				    __btf_name_by_offset(btf,
4471							 enums[i].name_off));
4472
4473		btf_show_end_type(show);
4474		return;
4475	}
4476
4477	if (btf_type_kflag(t))
4478		btf_show_type_value(show, "%lld", v);
4479	else
4480		btf_show_type_value(show, "%llu", v);
4481	btf_show_end_type(show);
4482}
4483
4484static const struct btf_kind_operations enum64_ops = {
4485	.check_meta = btf_enum64_check_meta,
4486	.resolve = btf_df_resolve,
4487	.check_member = btf_enum_check_member,
4488	.check_kflag_member = btf_enum_check_kflag_member,
4489	.log_details = btf_enum_log,
4490	.show = btf_enum64_show,
4491};
4492
4493static s32 btf_func_proto_check_meta(struct btf_verifier_env *env,
4494				     const struct btf_type *t,
4495				     u32 meta_left)
4496{
4497	u32 meta_needed = btf_type_vlen(t) * sizeof(struct btf_param);
4498
4499	if (meta_left < meta_needed) {
4500		btf_verifier_log_basic(env, t,
4501				       "meta_left:%u meta_needed:%u",
4502				       meta_left, meta_needed);
4503		return -EINVAL;
4504	}
4505
4506	if (t->name_off) {
4507		btf_verifier_log_type(env, t, "Invalid name");
4508		return -EINVAL;
4509	}
4510
4511	if (btf_type_kflag(t)) {
4512		btf_verifier_log_type(env, t, "Invalid btf_info kind_flag");
4513		return -EINVAL;
4514	}
4515
4516	btf_verifier_log_type(env, t, NULL);
4517
4518	return meta_needed;
4519}
4520
4521static void btf_func_proto_log(struct btf_verifier_env *env,
4522			       const struct btf_type *t)
4523{
4524	const struct btf_param *args = (const struct btf_param *)(t + 1);
4525	u16 nr_args = btf_type_vlen(t), i;
4526
4527	btf_verifier_log(env, "return=%u args=(", t->type);
4528	if (!nr_args) {
4529		btf_verifier_log(env, "void");
4530		goto done;
4531	}
4532
4533	if (nr_args == 1 && !args[0].type) {
4534		/* Only one vararg */
4535		btf_verifier_log(env, "vararg");
4536		goto done;
4537	}
4538
4539	btf_verifier_log(env, "%u %s", args[0].type,
4540			 __btf_name_by_offset(env->btf,
4541					      args[0].name_off));
4542	for (i = 1; i < nr_args - 1; i++)
4543		btf_verifier_log(env, ", %u %s", args[i].type,
4544				 __btf_name_by_offset(env->btf,
4545						      args[i].name_off));
4546
4547	if (nr_args > 1) {
4548		const struct btf_param *last_arg = &args[nr_args - 1];
4549
4550		if (last_arg->type)
4551			btf_verifier_log(env, ", %u %s", last_arg->type,
4552					 __btf_name_by_offset(env->btf,
4553							      last_arg->name_off));
4554		else
4555			btf_verifier_log(env, ", vararg");
4556	}
4557
4558done:
4559	btf_verifier_log(env, ")");
4560}
4561
4562static const struct btf_kind_operations func_proto_ops = {
4563	.check_meta = btf_func_proto_check_meta,
4564	.resolve = btf_df_resolve,
4565	/*
4566	 * BTF_KIND_FUNC_PROTO cannot be directly referred by
4567	 * a struct's member.
4568	 *
4569	 * It should be a function pointer instead.
4570	 * (i.e. struct's member -> BTF_KIND_PTR -> BTF_KIND_FUNC_PROTO)
4571	 *
4572	 * Hence, there is no btf_func_check_member().
4573	 */
4574	.check_member = btf_df_check_member,
4575	.check_kflag_member = btf_df_check_kflag_member,
4576	.log_details = btf_func_proto_log,
4577	.show = btf_df_show,
4578};
4579
4580static s32 btf_func_check_meta(struct btf_verifier_env *env,
4581			       const struct btf_type *t,
4582			       u32 meta_left)
4583{
4584	if (!t->name_off ||
4585	    !btf_name_valid_identifier(env->btf, t->name_off)) {
4586		btf_verifier_log_type(env, t, "Invalid name");
4587		return -EINVAL;
4588	}
4589
4590	if (btf_type_vlen(t) > BTF_FUNC_GLOBAL) {
4591		btf_verifier_log_type(env, t, "Invalid func linkage");
4592		return -EINVAL;
4593	}
4594
4595	if (btf_type_kflag(t)) {
4596		btf_verifier_log_type(env, t, "Invalid btf_info kind_flag");
4597		return -EINVAL;
4598	}
4599
4600	btf_verifier_log_type(env, t, NULL);
4601
4602	return 0;
4603}
4604
4605static int btf_func_resolve(struct btf_verifier_env *env,
4606			    const struct resolve_vertex *v)
4607{
4608	const struct btf_type *t = v->t;
4609	u32 next_type_id = t->type;
4610	int err;
4611
4612	err = btf_func_check(env, t);
4613	if (err)
4614		return err;
4615
4616	env_stack_pop_resolved(env, next_type_id, 0);
4617	return 0;
4618}
4619
4620static const struct btf_kind_operations func_ops = {
4621	.check_meta = btf_func_check_meta,
4622	.resolve = btf_func_resolve,
4623	.check_member = btf_df_check_member,
4624	.check_kflag_member = btf_df_check_kflag_member,
4625	.log_details = btf_ref_type_log,
4626	.show = btf_df_show,
4627};
4628
4629static s32 btf_var_check_meta(struct btf_verifier_env *env,
4630			      const struct btf_type *t,
4631			      u32 meta_left)
4632{
4633	const struct btf_var *var;
4634	u32 meta_needed = sizeof(*var);
4635
4636	if (meta_left < meta_needed) {
4637		btf_verifier_log_basic(env, t,
4638				       "meta_left:%u meta_needed:%u",
4639				       meta_left, meta_needed);
4640		return -EINVAL;
4641	}
4642
4643	if (btf_type_vlen(t)) {
4644		btf_verifier_log_type(env, t, "vlen != 0");
4645		return -EINVAL;
4646	}
4647
4648	if (btf_type_kflag(t)) {
4649		btf_verifier_log_type(env, t, "Invalid btf_info kind_flag");
4650		return -EINVAL;
4651	}
4652
4653	if (!t->name_off ||
4654	    !btf_name_valid_identifier(env->btf, t->name_off)) {
4655		btf_verifier_log_type(env, t, "Invalid name");
4656		return -EINVAL;
4657	}
4658
4659	/* A var cannot be in type void */
4660	if (!t->type || !BTF_TYPE_ID_VALID(t->type)) {
4661		btf_verifier_log_type(env, t, "Invalid type_id");
4662		return -EINVAL;
4663	}
4664
4665	var = btf_type_var(t);
4666	if (var->linkage != BTF_VAR_STATIC &&
4667	    var->linkage != BTF_VAR_GLOBAL_ALLOCATED) {
4668		btf_verifier_log_type(env, t, "Linkage not supported");
4669		return -EINVAL;
4670	}
4671
4672	btf_verifier_log_type(env, t, NULL);
4673
4674	return meta_needed;
4675}
4676
4677static void btf_var_log(struct btf_verifier_env *env, const struct btf_type *t)
4678{
4679	const struct btf_var *var = btf_type_var(t);
4680
4681	btf_verifier_log(env, "type_id=%u linkage=%u", t->type, var->linkage);
4682}
4683
4684static const struct btf_kind_operations var_ops = {
4685	.check_meta		= btf_var_check_meta,
4686	.resolve		= btf_var_resolve,
4687	.check_member		= btf_df_check_member,
4688	.check_kflag_member	= btf_df_check_kflag_member,
4689	.log_details		= btf_var_log,
4690	.show			= btf_var_show,
4691};
4692
4693static s32 btf_datasec_check_meta(struct btf_verifier_env *env,
4694				  const struct btf_type *t,
4695				  u32 meta_left)
4696{
4697	const struct btf_var_secinfo *vsi;
4698	u64 last_vsi_end_off = 0, sum = 0;
4699	u32 i, meta_needed;
4700
4701	meta_needed = btf_type_vlen(t) * sizeof(*vsi);
4702	if (meta_left < meta_needed) {
4703		btf_verifier_log_basic(env, t,
4704				       "meta_left:%u meta_needed:%u",
4705				       meta_left, meta_needed);
4706		return -EINVAL;
4707	}
4708
4709	if (!t->size) {
4710		btf_verifier_log_type(env, t, "size == 0");
4711		return -EINVAL;
4712	}
4713
4714	if (btf_type_kflag(t)) {
4715		btf_verifier_log_type(env, t, "Invalid btf_info kind_flag");
4716		return -EINVAL;
4717	}
4718
4719	if (!t->name_off ||
4720	    !btf_name_valid_section(env->btf, t->name_off)) {
4721		btf_verifier_log_type(env, t, "Invalid name");
4722		return -EINVAL;
4723	}
4724
4725	btf_verifier_log_type(env, t, NULL);
4726
4727	for_each_vsi(i, t, vsi) {
4728		/* A var cannot be in type void */
4729		if (!vsi->type || !BTF_TYPE_ID_VALID(vsi->type)) {
4730			btf_verifier_log_vsi(env, t, vsi,
4731					     "Invalid type_id");
4732			return -EINVAL;
4733		}
4734
4735		if (vsi->offset < last_vsi_end_off || vsi->offset >= t->size) {
4736			btf_verifier_log_vsi(env, t, vsi,
4737					     "Invalid offset");
4738			return -EINVAL;
4739		}
4740
4741		if (!vsi->size || vsi->size > t->size) {
4742			btf_verifier_log_vsi(env, t, vsi,
4743					     "Invalid size");
4744			return -EINVAL;
4745		}
4746
4747		last_vsi_end_off = vsi->offset + vsi->size;
4748		if (last_vsi_end_off > t->size) {
4749			btf_verifier_log_vsi(env, t, vsi,
4750					     "Invalid offset+size");
4751			return -EINVAL;
4752		}
4753
4754		btf_verifier_log_vsi(env, t, vsi, NULL);
4755		sum += vsi->size;
4756	}
4757
4758	if (t->size < sum) {
4759		btf_verifier_log_type(env, t, "Invalid btf_info size");
4760		return -EINVAL;
4761	}
4762
4763	return meta_needed;
4764}
4765
4766static int btf_datasec_resolve(struct btf_verifier_env *env,
4767			       const struct resolve_vertex *v)
4768{
4769	const struct btf_var_secinfo *vsi;
4770	struct btf *btf = env->btf;
4771	u16 i;
4772
4773	env->resolve_mode = RESOLVE_TBD;
4774	for_each_vsi_from(i, v->next_member, v->t, vsi) {
4775		u32 var_type_id = vsi->type, type_id, type_size = 0;
4776		const struct btf_type *var_type = btf_type_by_id(env->btf,
4777								 var_type_id);
4778		if (!var_type || !btf_type_is_var(var_type)) {
4779			btf_verifier_log_vsi(env, v->t, vsi,
4780					     "Not a VAR kind member");
4781			return -EINVAL;
4782		}
4783
4784		if (!env_type_is_resolve_sink(env, var_type) &&
4785		    !env_type_is_resolved(env, var_type_id)) {
4786			env_stack_set_next_member(env, i + 1);
4787			return env_stack_push(env, var_type, var_type_id);
4788		}
4789
4790		type_id = var_type->type;
4791		if (!btf_type_id_size(btf, &type_id, &type_size)) {
4792			btf_verifier_log_vsi(env, v->t, vsi, "Invalid type");
4793			return -EINVAL;
4794		}
4795
4796		if (vsi->size < type_size) {
4797			btf_verifier_log_vsi(env, v->t, vsi, "Invalid size");
4798			return -EINVAL;
4799		}
4800	}
4801
4802	env_stack_pop_resolved(env, 0, 0);
4803	return 0;
4804}
4805
4806static void btf_datasec_log(struct btf_verifier_env *env,
4807			    const struct btf_type *t)
4808{
4809	btf_verifier_log(env, "size=%u vlen=%u", t->size, btf_type_vlen(t));
4810}
4811
4812static void btf_datasec_show(const struct btf *btf,
4813			     const struct btf_type *t, u32 type_id,
4814			     void *data, u8 bits_offset,
4815			     struct btf_show *show)
4816{
4817	const struct btf_var_secinfo *vsi;
4818	const struct btf_type *var;
4819	u32 i;
4820
4821	if (!btf_show_start_type(show, t, type_id, data))
4822		return;
4823
4824	btf_show_type_value(show, "section (\"%s\") = {",
4825			    __btf_name_by_offset(btf, t->name_off));
4826	for_each_vsi(i, t, vsi) {
4827		var = btf_type_by_id(btf, vsi->type);
4828		if (i)
4829			btf_show(show, ",");
4830		btf_type_ops(var)->show(btf, var, vsi->type,
4831					data + vsi->offset, bits_offset, show);
4832	}
4833	btf_show_end_type(show);
4834}
4835
4836static const struct btf_kind_operations datasec_ops = {
4837	.check_meta		= btf_datasec_check_meta,
4838	.resolve		= btf_datasec_resolve,
4839	.check_member		= btf_df_check_member,
4840	.check_kflag_member	= btf_df_check_kflag_member,
4841	.log_details		= btf_datasec_log,
4842	.show			= btf_datasec_show,
4843};
4844
4845static s32 btf_float_check_meta(struct btf_verifier_env *env,
4846				const struct btf_type *t,
4847				u32 meta_left)
4848{
4849	if (btf_type_vlen(t)) {
4850		btf_verifier_log_type(env, t, "vlen != 0");
4851		return -EINVAL;
4852	}
4853
4854	if (btf_type_kflag(t)) {
4855		btf_verifier_log_type(env, t, "Invalid btf_info kind_flag");
4856		return -EINVAL;
4857	}
4858
4859	if (t->size != 2 && t->size != 4 && t->size != 8 && t->size != 12 &&
4860	    t->size != 16) {
4861		btf_verifier_log_type(env, t, "Invalid type_size");
4862		return -EINVAL;
4863	}
4864
4865	btf_verifier_log_type(env, t, NULL);
4866
4867	return 0;
4868}
4869
4870static int btf_float_check_member(struct btf_verifier_env *env,
4871				  const struct btf_type *struct_type,
4872				  const struct btf_member *member,
4873				  const struct btf_type *member_type)
4874{
4875	u64 start_offset_bytes;
4876	u64 end_offset_bytes;
4877	u64 misalign_bits;
4878	u64 align_bytes;
4879	u64 align_bits;
4880
4881	/* Different architectures have different alignment requirements, so
4882	 * here we check only for the reasonable minimum. This way we ensure
4883	 * that types after CO-RE can pass the kernel BTF verifier.
4884	 */
4885	align_bytes = min_t(u64, sizeof(void *), member_type->size);
4886	align_bits = align_bytes * BITS_PER_BYTE;
4887	div64_u64_rem(member->offset, align_bits, &misalign_bits);
4888	if (misalign_bits) {
4889		btf_verifier_log_member(env, struct_type, member,
4890					"Member is not properly aligned");
4891		return -EINVAL;
4892	}
4893
4894	start_offset_bytes = member->offset / BITS_PER_BYTE;
4895	end_offset_bytes = start_offset_bytes + member_type->size;
4896	if (end_offset_bytes > struct_type->size) {
4897		btf_verifier_log_member(env, struct_type, member,
4898					"Member exceeds struct_size");
4899		return -EINVAL;
4900	}
4901
4902	return 0;
4903}
4904
4905static void btf_float_log(struct btf_verifier_env *env,
4906			  const struct btf_type *t)
4907{
4908	btf_verifier_log(env, "size=%u", t->size);
4909}
4910
4911static const struct btf_kind_operations float_ops = {
4912	.check_meta = btf_float_check_meta,
4913	.resolve = btf_df_resolve,
4914	.check_member = btf_float_check_member,
4915	.check_kflag_member = btf_generic_check_kflag_member,
4916	.log_details = btf_float_log,
4917	.show = btf_df_show,
4918};
4919
4920static s32 btf_decl_tag_check_meta(struct btf_verifier_env *env,
4921			      const struct btf_type *t,
4922			      u32 meta_left)
4923{
4924	const struct btf_decl_tag *tag;
4925	u32 meta_needed = sizeof(*tag);
4926	s32 component_idx;
4927	const char *value;
4928
4929	if (meta_left < meta_needed) {
4930		btf_verifier_log_basic(env, t,
4931				       "meta_left:%u meta_needed:%u",
4932				       meta_left, meta_needed);
4933		return -EINVAL;
4934	}
4935
4936	value = btf_name_by_offset(env->btf, t->name_off);
4937	if (!value || !value[0]) {
4938		btf_verifier_log_type(env, t, "Invalid value");
4939		return -EINVAL;
4940	}
4941
4942	if (btf_type_vlen(t)) {
4943		btf_verifier_log_type(env, t, "vlen != 0");
4944		return -EINVAL;
4945	}
4946
4947	if (btf_type_kflag(t)) {
4948		btf_verifier_log_type(env, t, "Invalid btf_info kind_flag");
4949		return -EINVAL;
4950	}
4951
4952	component_idx = btf_type_decl_tag(t)->component_idx;
4953	if (component_idx < -1) {
4954		btf_verifier_log_type(env, t, "Invalid component_idx");
4955		return -EINVAL;
4956	}
4957
4958	btf_verifier_log_type(env, t, NULL);
4959
4960	return meta_needed;
4961}
4962
4963static int btf_decl_tag_resolve(struct btf_verifier_env *env,
4964			   const struct resolve_vertex *v)
4965{
4966	const struct btf_type *next_type;
4967	const struct btf_type *t = v->t;
4968	u32 next_type_id = t->type;
4969	struct btf *btf = env->btf;
4970	s32 component_idx;
4971	u32 vlen;
4972
4973	next_type = btf_type_by_id(btf, next_type_id);
4974	if (!next_type || !btf_type_is_decl_tag_target(next_type)) {
4975		btf_verifier_log_type(env, v->t, "Invalid type_id");
4976		return -EINVAL;
4977	}
4978
4979	if (!env_type_is_resolve_sink(env, next_type) &&
4980	    !env_type_is_resolved(env, next_type_id))
4981		return env_stack_push(env, next_type, next_type_id);
4982
4983	component_idx = btf_type_decl_tag(t)->component_idx;
4984	if (component_idx != -1) {
4985		if (btf_type_is_var(next_type) || btf_type_is_typedef(next_type)) {
4986			btf_verifier_log_type(env, v->t, "Invalid component_idx");
4987			return -EINVAL;
4988		}
4989
4990		if (btf_type_is_struct(next_type)) {
4991			vlen = btf_type_vlen(next_type);
4992		} else {
4993			/* next_type should be a function */
4994			next_type = btf_type_by_id(btf, next_type->type);
4995			vlen = btf_type_vlen(next_type);
4996		}
4997
4998		if ((u32)component_idx >= vlen) {
4999			btf_verifier_log_type(env, v->t, "Invalid component_idx");
5000			return -EINVAL;
5001		}
5002	}
5003
5004	env_stack_pop_resolved(env, next_type_id, 0);
5005
5006	return 0;
5007}
5008
5009static void btf_decl_tag_log(struct btf_verifier_env *env, const struct btf_type *t)
5010{
5011	btf_verifier_log(env, "type=%u component_idx=%d", t->type,
5012			 btf_type_decl_tag(t)->component_idx);
5013}
5014
5015static const struct btf_kind_operations decl_tag_ops = {
5016	.check_meta = btf_decl_tag_check_meta,
5017	.resolve = btf_decl_tag_resolve,
5018	.check_member = btf_df_check_member,
5019	.check_kflag_member = btf_df_check_kflag_member,
5020	.log_details = btf_decl_tag_log,
5021	.show = btf_df_show,
5022};
5023
5024static int btf_func_proto_check(struct btf_verifier_env *env,
5025				const struct btf_type *t)
5026{
5027	const struct btf_type *ret_type;
5028	const struct btf_param *args;
5029	const struct btf *btf;
5030	u16 nr_args, i;
5031	int err;
5032
5033	btf = env->btf;
5034	args = (const struct btf_param *)(t + 1);
5035	nr_args = btf_type_vlen(t);
5036
5037	/* Check func return type which could be "void" (t->type == 0) */
5038	if (t->type) {
5039		u32 ret_type_id = t->type;
5040
5041		ret_type = btf_type_by_id(btf, ret_type_id);
5042		if (!ret_type) {
5043			btf_verifier_log_type(env, t, "Invalid return type");
5044			return -EINVAL;
5045		}
5046
5047		if (btf_type_is_resolve_source_only(ret_type)) {
5048			btf_verifier_log_type(env, t, "Invalid return type");
5049			return -EINVAL;
5050		}
5051
5052		if (btf_type_needs_resolve(ret_type) &&
5053		    !env_type_is_resolved(env, ret_type_id)) {
5054			err = btf_resolve(env, ret_type, ret_type_id);
5055			if (err)
5056				return err;
5057		}
5058
5059		/* Ensure the return type is a type that has a size */
5060		if (!btf_type_id_size(btf, &ret_type_id, NULL)) {
5061			btf_verifier_log_type(env, t, "Invalid return type");
5062			return -EINVAL;
5063		}
5064	}
5065
5066	if (!nr_args)
5067		return 0;
5068
5069	/* Last func arg type_id could be 0 if it is a vararg */
5070	if (!args[nr_args - 1].type) {
5071		if (args[nr_args - 1].name_off) {
5072			btf_verifier_log_type(env, t, "Invalid arg#%u",
5073					      nr_args);
5074			return -EINVAL;
5075		}
5076		nr_args--;
5077	}
5078
5079	for (i = 0; i < nr_args; i++) {
5080		const struct btf_type *arg_type;
5081		u32 arg_type_id;
5082
5083		arg_type_id = args[i].type;
5084		arg_type = btf_type_by_id(btf, arg_type_id);
5085		if (!arg_type) {
5086			btf_verifier_log_type(env, t, "Invalid arg#%u", i + 1);
5087			return -EINVAL;
5088		}
5089
5090		if (btf_type_is_resolve_source_only(arg_type)) {
5091			btf_verifier_log_type(env, t, "Invalid arg#%u", i + 1);
5092			return -EINVAL;
5093		}
5094
5095		if (args[i].name_off &&
5096		    (!btf_name_offset_valid(btf, args[i].name_off) ||
5097		     !btf_name_valid_identifier(btf, args[i].name_off))) {
5098			btf_verifier_log_type(env, t,
5099					      "Invalid arg#%u", i + 1);
5100			return -EINVAL;
5101		}
5102
5103		if (btf_type_needs_resolve(arg_type) &&
5104		    !env_type_is_resolved(env, arg_type_id)) {
5105			err = btf_resolve(env, arg_type, arg_type_id);
5106			if (err)
5107				return err;
5108		}
5109
5110		if (!btf_type_id_size(btf, &arg_type_id, NULL)) {
5111			btf_verifier_log_type(env, t, "Invalid arg#%u", i + 1);
5112			return -EINVAL;
5113		}
5114	}
5115
5116	return 0;
5117}
5118
5119static int btf_func_check(struct btf_verifier_env *env,
5120			  const struct btf_type *t)
5121{
5122	const struct btf_type *proto_type;
5123	const struct btf_param *args;
5124	const struct btf *btf;
5125	u16 nr_args, i;
5126
5127	btf = env->btf;
5128	proto_type = btf_type_by_id(btf, t->type);
5129
5130	if (!proto_type || !btf_type_is_func_proto(proto_type)) {
5131		btf_verifier_log_type(env, t, "Invalid type_id");
5132		return -EINVAL;
5133	}
5134
5135	args = (const struct btf_param *)(proto_type + 1);
5136	nr_args = btf_type_vlen(proto_type);
5137	for (i = 0; i < nr_args; i++) {
5138		if (!args[i].name_off && args[i].type) {
5139			btf_verifier_log_type(env, t, "Invalid arg#%u", i + 1);
5140			return -EINVAL;
5141		}
5142	}
5143
5144	return 0;
5145}
5146
5147static const struct btf_kind_operations * const kind_ops[NR_BTF_KINDS] = {
5148	[BTF_KIND_INT] = &int_ops,
5149	[BTF_KIND_PTR] = &ptr_ops,
5150	[BTF_KIND_ARRAY] = &array_ops,
5151	[BTF_KIND_STRUCT] = &struct_ops,
5152	[BTF_KIND_UNION] = &struct_ops,
5153	[BTF_KIND_ENUM] = &enum_ops,
5154	[BTF_KIND_FWD] = &fwd_ops,
5155	[BTF_KIND_TYPEDEF] = &modifier_ops,
5156	[BTF_KIND_VOLATILE] = &modifier_ops,
5157	[BTF_KIND_CONST] = &modifier_ops,
5158	[BTF_KIND_RESTRICT] = &modifier_ops,
5159	[BTF_KIND_FUNC] = &func_ops,
5160	[BTF_KIND_FUNC_PROTO] = &func_proto_ops,
5161	[BTF_KIND_VAR] = &var_ops,
5162	[BTF_KIND_DATASEC] = &datasec_ops,
5163	[BTF_KIND_FLOAT] = &float_ops,
5164	[BTF_KIND_DECL_TAG] = &decl_tag_ops,
5165	[BTF_KIND_TYPE_TAG] = &modifier_ops,
5166	[BTF_KIND_ENUM64] = &enum64_ops,
5167};
5168
5169static s32 btf_check_meta(struct btf_verifier_env *env,
5170			  const struct btf_type *t,
5171			  u32 meta_left)
5172{
5173	u32 saved_meta_left = meta_left;
5174	s32 var_meta_size;
5175
5176	if (meta_left < sizeof(*t)) {
5177		btf_verifier_log(env, "[%u] meta_left:%u meta_needed:%zu",
5178				 env->log_type_id, meta_left, sizeof(*t));
5179		return -EINVAL;
5180	}
5181	meta_left -= sizeof(*t);
5182
5183	if (t->info & ~BTF_INFO_MASK) {
5184		btf_verifier_log(env, "[%u] Invalid btf_info:%x",
5185				 env->log_type_id, t->info);
5186		return -EINVAL;
5187	}
5188
5189	if (BTF_INFO_KIND(t->info) > BTF_KIND_MAX ||
5190	    BTF_INFO_KIND(t->info) == BTF_KIND_UNKN) {
5191		btf_verifier_log(env, "[%u] Invalid kind:%u",
5192				 env->log_type_id, BTF_INFO_KIND(t->info));
5193		return -EINVAL;
5194	}
5195
5196	if (!btf_name_offset_valid(env->btf, t->name_off)) {
5197		btf_verifier_log(env, "[%u] Invalid name_offset:%u",
5198				 env->log_type_id, t->name_off);
5199		return -EINVAL;
5200	}
5201
5202	var_meta_size = btf_type_ops(t)->check_meta(env, t, meta_left);
5203	if (var_meta_size < 0)
5204		return var_meta_size;
5205
5206	meta_left -= var_meta_size;
5207
5208	return saved_meta_left - meta_left;
5209}
5210
5211static int btf_check_all_metas(struct btf_verifier_env *env)
5212{
5213	struct btf *btf = env->btf;
5214	struct btf_header *hdr;
5215	void *cur, *end;
5216
5217	hdr = &btf->hdr;
5218	cur = btf->nohdr_data + hdr->type_off;
5219	end = cur + hdr->type_len;
5220
5221	env->log_type_id = btf->base_btf ? btf->start_id : 1;
5222	while (cur < end) {
5223		struct btf_type *t = cur;
5224		s32 meta_size;
5225
5226		meta_size = btf_check_meta(env, t, end - cur);
5227		if (meta_size < 0)
5228			return meta_size;
5229
5230		btf_add_type(env, t);
5231		cur += meta_size;
5232		env->log_type_id++;
5233	}
5234
5235	return 0;
5236}
5237
5238static bool btf_resolve_valid(struct btf_verifier_env *env,
5239			      const struct btf_type *t,
5240			      u32 type_id)
5241{
5242	struct btf *btf = env->btf;
5243
5244	if (!env_type_is_resolved(env, type_id))
5245		return false;
5246
5247	if (btf_type_is_struct(t) || btf_type_is_datasec(t))
5248		return !btf_resolved_type_id(btf, type_id) &&
5249		       !btf_resolved_type_size(btf, type_id);
5250
5251	if (btf_type_is_decl_tag(t) || btf_type_is_func(t))
5252		return btf_resolved_type_id(btf, type_id) &&
5253		       !btf_resolved_type_size(btf, type_id);
5254
5255	if (btf_type_is_modifier(t) || btf_type_is_ptr(t) ||
5256	    btf_type_is_var(t)) {
5257		t = btf_type_id_resolve(btf, &type_id);
5258		return t &&
5259		       !btf_type_is_modifier(t) &&
5260		       !btf_type_is_var(t) &&
5261		       !btf_type_is_datasec(t);
5262	}
5263
5264	if (btf_type_is_array(t)) {
5265		const struct btf_array *array = btf_type_array(t);
5266		const struct btf_type *elem_type;
5267		u32 elem_type_id = array->type;
5268		u32 elem_size;
5269
5270		elem_type = btf_type_id_size(btf, &elem_type_id, &elem_size);
5271		return elem_type && !btf_type_is_modifier(elem_type) &&
5272			(array->nelems * elem_size ==
5273			 btf_resolved_type_size(btf, type_id));
5274	}
5275
5276	return false;
5277}
5278
5279static int btf_resolve(struct btf_verifier_env *env,
5280		       const struct btf_type *t, u32 type_id)
5281{
5282	u32 save_log_type_id = env->log_type_id;
5283	const struct resolve_vertex *v;
5284	int err = 0;
5285
5286	env->resolve_mode = RESOLVE_TBD;
5287	env_stack_push(env, t, type_id);
5288	while (!err && (v = env_stack_peak(env))) {
5289		env->log_type_id = v->type_id;
5290		err = btf_type_ops(v->t)->resolve(env, v);
5291	}
5292
5293	env->log_type_id = type_id;
5294	if (err == -E2BIG) {
5295		btf_verifier_log_type(env, t,
5296				      "Exceeded max resolving depth:%u",
5297				      MAX_RESOLVE_DEPTH);
5298	} else if (err == -EEXIST) {
5299		btf_verifier_log_type(env, t, "Loop detected");
5300	}
5301
5302	/* Final sanity check */
5303	if (!err && !btf_resolve_valid(env, t, type_id)) {
5304		btf_verifier_log_type(env, t, "Invalid resolve state");
5305		err = -EINVAL;
5306	}
5307
5308	env->log_type_id = save_log_type_id;
5309	return err;
5310}
5311
5312static int btf_check_all_types(struct btf_verifier_env *env)
5313{
5314	struct btf *btf = env->btf;
5315	const struct btf_type *t;
5316	u32 type_id, i;
5317	int err;
5318
5319	err = env_resolve_init(env);
5320	if (err)
5321		return err;
5322
5323	env->phase++;
5324	for (i = btf->base_btf ? 0 : 1; i < btf->nr_types; i++) {
5325		type_id = btf->start_id + i;
5326		t = btf_type_by_id(btf, type_id);
5327
5328		env->log_type_id = type_id;
5329		if (btf_type_needs_resolve(t) &&
5330		    !env_type_is_resolved(env, type_id)) {
5331			err = btf_resolve(env, t, type_id);
5332			if (err)
5333				return err;
5334		}
5335
5336		if (btf_type_is_func_proto(t)) {
5337			err = btf_func_proto_check(env, t);
5338			if (err)
5339				return err;
5340		}
5341	}
5342
5343	return 0;
5344}
5345
5346static int btf_parse_type_sec(struct btf_verifier_env *env)
5347{
5348	const struct btf_header *hdr = &env->btf->hdr;
5349	int err;
5350
5351	/* Type section must align to 4 bytes */
5352	if (hdr->type_off & (sizeof(u32) - 1)) {
5353		btf_verifier_log(env, "Unaligned type_off");
5354		return -EINVAL;
5355	}
5356
5357	if (!env->btf->base_btf && !hdr->type_len) {
5358		btf_verifier_log(env, "No type found");
5359		return -EINVAL;
5360	}
5361
5362	err = btf_check_all_metas(env);
5363	if (err)
5364		return err;
5365
5366	return btf_check_all_types(env);
5367}
5368
5369static int btf_parse_str_sec(struct btf_verifier_env *env)
5370{
5371	const struct btf_header *hdr;
5372	struct btf *btf = env->btf;
5373	const char *start, *end;
5374
5375	hdr = &btf->hdr;
5376	start = btf->nohdr_data + hdr->str_off;
5377	end = start + hdr->str_len;
5378
5379	if (end != btf->data + btf->data_size) {
5380		btf_verifier_log(env, "String section is not at the end");
5381		return -EINVAL;
5382	}
5383
5384	btf->strings = start;
5385
5386	if (btf->base_btf && !hdr->str_len)
5387		return 0;
5388	if (!hdr->str_len || hdr->str_len - 1 > BTF_MAX_NAME_OFFSET || end[-1]) {
5389		btf_verifier_log(env, "Invalid string section");
5390		return -EINVAL;
5391	}
5392	if (!btf->base_btf && start[0]) {
5393		btf_verifier_log(env, "Invalid string section");
5394		return -EINVAL;
5395	}
5396
5397	return 0;
5398}
5399
5400static const size_t btf_sec_info_offset[] = {
5401	offsetof(struct btf_header, type_off),
5402	offsetof(struct btf_header, str_off),
5403};
5404
5405static int btf_sec_info_cmp(const void *a, const void *b)
5406{
5407	const struct btf_sec_info *x = a;
5408	const struct btf_sec_info *y = b;
5409
5410	return (int)(x->off - y->off) ? : (int)(x->len - y->len);
5411}
5412
5413static int btf_check_sec_info(struct btf_verifier_env *env,
5414			      u32 btf_data_size)
5415{
5416	struct btf_sec_info secs[ARRAY_SIZE(btf_sec_info_offset)];
5417	u32 total, expected_total, i;
5418	const struct btf_header *hdr;
5419	const struct btf *btf;
5420
5421	btf = env->btf;
5422	hdr = &btf->hdr;
5423
5424	/* Populate the secs from hdr */
5425	for (i = 0; i < ARRAY_SIZE(btf_sec_info_offset); i++)
5426		secs[i] = *(struct btf_sec_info *)((void *)hdr +
5427						   btf_sec_info_offset[i]);
5428
5429	sort(secs, ARRAY_SIZE(btf_sec_info_offset),
5430	     sizeof(struct btf_sec_info), btf_sec_info_cmp, NULL);
5431
5432	/* Check for gaps and overlap among sections */
5433	total = 0;
5434	expected_total = btf_data_size - hdr->hdr_len;
5435	for (i = 0; i < ARRAY_SIZE(btf_sec_info_offset); i++) {
5436		if (expected_total < secs[i].off) {
5437			btf_verifier_log(env, "Invalid section offset");
5438			return -EINVAL;
5439		}
5440		if (total < secs[i].off) {
5441			/* gap */
5442			btf_verifier_log(env, "Unsupported section found");
5443			return -EINVAL;
5444		}
5445		if (total > secs[i].off) {
5446			btf_verifier_log(env, "Section overlap found");
5447			return -EINVAL;
5448		}
5449		if (expected_total - total < secs[i].len) {
5450			btf_verifier_log(env,
5451					 "Total section length too long");
5452			return -EINVAL;
5453		}
5454		total += secs[i].len;
5455	}
5456
5457	/* There is data other than hdr and known sections */
5458	if (expected_total != total) {
5459		btf_verifier_log(env, "Unsupported section found");
5460		return -EINVAL;
5461	}
5462
5463	return 0;
5464}
5465
5466static int btf_parse_hdr(struct btf_verifier_env *env)
5467{
5468	u32 hdr_len, hdr_copy, btf_data_size;
5469	const struct btf_header *hdr;
5470	struct btf *btf;
5471
5472	btf = env->btf;
5473	btf_data_size = btf->data_size;
5474
5475	if (btf_data_size < offsetofend(struct btf_header, hdr_len)) {
5476		btf_verifier_log(env, "hdr_len not found");
5477		return -EINVAL;
5478	}
5479
5480	hdr = btf->data;
5481	hdr_len = hdr->hdr_len;
5482	if (btf_data_size < hdr_len) {
5483		btf_verifier_log(env, "btf_header not found");
5484		return -EINVAL;
5485	}
5486
5487	/* Ensure the unsupported header fields are zero */
5488	if (hdr_len > sizeof(btf->hdr)) {
5489		u8 *expected_zero = btf->data + sizeof(btf->hdr);
5490		u8 *end = btf->data + hdr_len;
5491
5492		for (; expected_zero < end; expected_zero++) {
5493			if (*expected_zero) {
5494				btf_verifier_log(env, "Unsupported btf_header");
5495				return -E2BIG;
5496			}
5497		}
5498	}
5499
5500	hdr_copy = min_t(u32, hdr_len, sizeof(btf->hdr));
5501	memcpy(&btf->hdr, btf->data, hdr_copy);
5502
5503	hdr = &btf->hdr;
5504
5505	btf_verifier_log_hdr(env, btf_data_size);
5506
5507	if (hdr->magic != BTF_MAGIC) {
5508		btf_verifier_log(env, "Invalid magic");
5509		return -EINVAL;
5510	}
5511
5512	if (hdr->version != BTF_VERSION) {
5513		btf_verifier_log(env, "Unsupported version");
5514		return -ENOTSUPP;
5515	}
5516
5517	if (hdr->flags) {
5518		btf_verifier_log(env, "Unsupported flags");
5519		return -ENOTSUPP;
5520	}
5521
5522	if (!btf->base_btf && btf_data_size == hdr->hdr_len) {
5523		btf_verifier_log(env, "No data");
5524		return -EINVAL;
5525	}
5526
5527	return btf_check_sec_info(env, btf_data_size);
5528}
5529
5530static const char *alloc_obj_fields[] = {
5531	"bpf_spin_lock",
5532	"bpf_list_head",
5533	"bpf_list_node",
5534	"bpf_rb_root",
5535	"bpf_rb_node",
5536	"bpf_refcount",
5537};
5538
5539static struct btf_struct_metas *
5540btf_parse_struct_metas(struct bpf_verifier_log *log, struct btf *btf)
5541{
 
 
 
 
 
 
 
5542	struct btf_struct_metas *tab = NULL;
5543	struct btf_id_set *aof;
5544	int i, n, id, ret;
5545
5546	BUILD_BUG_ON(offsetof(struct btf_id_set, cnt) != 0);
5547	BUILD_BUG_ON(sizeof(struct btf_id_set) != sizeof(u32));
5548
5549	aof = kmalloc(sizeof(*aof), GFP_KERNEL | __GFP_NOWARN);
5550	if (!aof)
5551		return ERR_PTR(-ENOMEM);
5552	aof->cnt = 0;
5553
5554	for (i = 0; i < ARRAY_SIZE(alloc_obj_fields); i++) {
5555		/* Try to find whether this special type exists in user BTF, and
5556		 * if so remember its ID so we can easily find it among members
5557		 * of structs that we iterate in the next loop.
5558		 */
5559		struct btf_id_set *new_aof;
5560
5561		id = btf_find_by_name_kind(btf, alloc_obj_fields[i], BTF_KIND_STRUCT);
5562		if (id < 0)
5563			continue;
5564
5565		new_aof = krealloc(aof, offsetof(struct btf_id_set, ids[aof->cnt + 1]),
5566				   GFP_KERNEL | __GFP_NOWARN);
5567		if (!new_aof) {
5568			ret = -ENOMEM;
5569			goto free_aof;
5570		}
5571		aof = new_aof;
5572		aof->ids[aof->cnt++] = id;
5573	}
5574
5575	n = btf_nr_types(btf);
5576	for (i = 1; i < n; i++) {
5577		/* Try to find if there are kptrs in user BTF and remember their ID */
5578		struct btf_id_set *new_aof;
5579		struct btf_field_info tmp;
5580		const struct btf_type *t;
5581
5582		t = btf_type_by_id(btf, i);
5583		if (!t) {
5584			ret = -EINVAL;
5585			goto free_aof;
5586		}
5587
5588		ret = btf_find_kptr(btf, t, 0, 0, &tmp, BPF_KPTR);
5589		if (ret != BTF_FIELD_FOUND)
5590			continue;
5591
5592		new_aof = krealloc(aof, offsetof(struct btf_id_set, ids[aof->cnt + 1]),
5593				   GFP_KERNEL | __GFP_NOWARN);
5594		if (!new_aof) {
5595			ret = -ENOMEM;
5596			goto free_aof;
5597		}
5598		aof = new_aof;
5599		aof->ids[aof->cnt++] = i;
5600	}
5601
5602	if (!aof->cnt) {
5603		kfree(aof);
5604		return NULL;
5605	}
5606	sort(&aof->ids, aof->cnt, sizeof(aof->ids[0]), btf_id_cmp_func, NULL);
5607
 
5608	for (i = 1; i < n; i++) {
5609		struct btf_struct_metas *new_tab;
5610		const struct btf_member *member;
 
5611		struct btf_struct_meta *type;
5612		struct btf_record *record;
5613		const struct btf_type *t;
5614		int j, tab_cnt;
5615
5616		t = btf_type_by_id(btf, i);
 
 
 
 
5617		if (!__btf_type_is_struct(t))
5618			continue;
5619
5620		cond_resched();
5621
5622		for_each_member(j, t, member) {
5623			if (btf_id_set_contains(aof, member->type))
5624				goto parse;
5625		}
5626		continue;
5627	parse:
5628		tab_cnt = tab ? tab->cnt : 0;
5629		new_tab = krealloc(tab, offsetof(struct btf_struct_metas, types[tab_cnt + 1]),
5630				   GFP_KERNEL | __GFP_NOWARN);
5631		if (!new_tab) {
5632			ret = -ENOMEM;
5633			goto free;
5634		}
5635		if (!tab)
5636			new_tab->cnt = 0;
5637		tab = new_tab;
5638
5639		type = &tab->types[tab->cnt];
5640		type->btf_id = i;
5641		record = btf_parse_fields(btf, t, BPF_SPIN_LOCK | BPF_LIST_HEAD | BPF_LIST_NODE |
5642						  BPF_RB_ROOT | BPF_RB_NODE | BPF_REFCOUNT |
5643						  BPF_KPTR, t->size);
5644		/* The record cannot be unset, treat it as an error if so */
5645		if (IS_ERR_OR_NULL(record)) {
5646			ret = PTR_ERR_OR_ZERO(record) ?: -EFAULT;
5647			goto free;
5648		}
 
 
 
 
 
 
 
 
 
5649		type->record = record;
 
5650		tab->cnt++;
5651	}
5652	kfree(aof);
5653	return tab;
5654free:
5655	btf_struct_metas_free(tab);
5656free_aof:
5657	kfree(aof);
5658	return ERR_PTR(ret);
5659}
5660
5661struct btf_struct_meta *btf_find_struct_meta(const struct btf *btf, u32 btf_id)
5662{
5663	struct btf_struct_metas *tab;
5664
5665	BUILD_BUG_ON(offsetof(struct btf_struct_meta, btf_id) != 0);
5666	tab = btf->struct_meta_tab;
5667	if (!tab)
5668		return NULL;
5669	return bsearch(&btf_id, tab->types, tab->cnt, sizeof(tab->types[0]), btf_id_cmp_func);
5670}
5671
5672static int btf_check_type_tags(struct btf_verifier_env *env,
5673			       struct btf *btf, int start_id)
5674{
5675	int i, n, good_id = start_id - 1;
5676	bool in_tags;
5677
5678	n = btf_nr_types(btf);
5679	for (i = start_id; i < n; i++) {
5680		const struct btf_type *t;
5681		int chain_limit = 32;
5682		u32 cur_id = i;
5683
5684		t = btf_type_by_id(btf, i);
5685		if (!t)
5686			return -EINVAL;
5687		if (!btf_type_is_modifier(t))
5688			continue;
5689
5690		cond_resched();
5691
5692		in_tags = btf_type_is_type_tag(t);
5693		while (btf_type_is_modifier(t)) {
5694			if (!chain_limit--) {
5695				btf_verifier_log(env, "Max chain length or cycle detected");
5696				return -ELOOP;
5697			}
5698			if (btf_type_is_type_tag(t)) {
5699				if (!in_tags) {
5700					btf_verifier_log(env, "Type tags don't precede modifiers");
5701					return -EINVAL;
5702				}
5703			} else if (in_tags) {
5704				in_tags = false;
5705			}
5706			if (cur_id <= good_id)
5707				break;
5708			/* Move to next type */
5709			cur_id = t->type;
5710			t = btf_type_by_id(btf, cur_id);
5711			if (!t)
5712				return -EINVAL;
5713		}
5714		good_id = i;
5715	}
5716	return 0;
5717}
5718
5719static int finalize_log(struct bpf_verifier_log *log, bpfptr_t uattr, u32 uattr_size)
 
5720{
5721	u32 log_true_size;
5722	int err;
5723
5724	err = bpf_vlog_finalize(log, &log_true_size);
5725
5726	if (uattr_size >= offsetofend(union bpf_attr, btf_log_true_size) &&
5727	    copy_to_bpfptr_offset(uattr, offsetof(union bpf_attr, btf_log_true_size),
5728				  &log_true_size, sizeof(log_true_size)))
5729		err = -EFAULT;
5730
5731	return err;
5732}
5733
5734static struct btf *btf_parse(const union bpf_attr *attr, bpfptr_t uattr, u32 uattr_size)
5735{
5736	bpfptr_t btf_data = make_bpfptr(attr->btf, uattr.is_kernel);
5737	char __user *log_ubuf = u64_to_user_ptr(attr->btf_log_buf);
5738	struct btf_struct_metas *struct_meta_tab;
5739	struct btf_verifier_env *env = NULL;
 
5740	struct btf *btf = NULL;
5741	u8 *data;
5742	int err, ret;
5743
5744	if (attr->btf_size > BTF_MAX_SIZE)
5745		return ERR_PTR(-E2BIG);
5746
5747	env = kzalloc(sizeof(*env), GFP_KERNEL | __GFP_NOWARN);
5748	if (!env)
5749		return ERR_PTR(-ENOMEM);
5750
5751	/* user could have requested verbose verifier output
5752	 * and supplied buffer to store the verification trace
5753	 */
5754	err = bpf_vlog_init(&env->log, attr->btf_log_level,
5755			    log_ubuf, attr->btf_log_size);
5756	if (err)
5757		goto errout_free;
 
 
 
 
 
 
 
 
5758
5759	btf = kzalloc(sizeof(*btf), GFP_KERNEL | __GFP_NOWARN);
5760	if (!btf) {
5761		err = -ENOMEM;
5762		goto errout;
5763	}
5764	env->btf = btf;
5765
5766	data = kvmalloc(attr->btf_size, GFP_KERNEL | __GFP_NOWARN);
5767	if (!data) {
5768		err = -ENOMEM;
5769		goto errout;
5770	}
5771
5772	btf->data = data;
5773	btf->data_size = attr->btf_size;
5774
5775	if (copy_from_bpfptr(data, btf_data, attr->btf_size)) {
5776		err = -EFAULT;
5777		goto errout;
5778	}
5779
5780	err = btf_parse_hdr(env);
5781	if (err)
5782		goto errout;
5783
5784	btf->nohdr_data = btf->data + btf->hdr.hdr_len;
5785
5786	err = btf_parse_str_sec(env);
5787	if (err)
5788		goto errout;
5789
5790	err = btf_parse_type_sec(env);
5791	if (err)
5792		goto errout;
5793
5794	err = btf_check_type_tags(env, btf, 1);
5795	if (err)
5796		goto errout;
5797
5798	struct_meta_tab = btf_parse_struct_metas(&env->log, btf);
5799	if (IS_ERR(struct_meta_tab)) {
5800		err = PTR_ERR(struct_meta_tab);
5801		goto errout;
5802	}
5803	btf->struct_meta_tab = struct_meta_tab;
5804
5805	if (struct_meta_tab) {
5806		int i;
5807
5808		for (i = 0; i < struct_meta_tab->cnt; i++) {
5809			err = btf_check_and_fixup_fields(btf, struct_meta_tab->types[i].record);
5810			if (err < 0)
5811				goto errout_meta;
5812		}
5813	}
5814
5815	err = finalize_log(&env->log, uattr, uattr_size);
5816	if (err)
5817		goto errout_free;
 
5818
5819	btf_verifier_env_free(env);
5820	refcount_set(&btf->refcnt, 1);
5821	return btf;
5822
5823errout_meta:
5824	btf_free_struct_meta_tab(btf);
5825errout:
5826	/* overwrite err with -ENOSPC or -EFAULT */
5827	ret = finalize_log(&env->log, uattr, uattr_size);
5828	if (ret)
5829		err = ret;
5830errout_free:
5831	btf_verifier_env_free(env);
5832	if (btf)
5833		btf_free(btf);
5834	return ERR_PTR(err);
5835}
5836
5837extern char __start_BTF[];
5838extern char __stop_BTF[];
5839extern struct btf *btf_vmlinux;
5840
5841#define BPF_MAP_TYPE(_id, _ops)
5842#define BPF_LINK_TYPE(_id, _name)
5843static union {
5844	struct bpf_ctx_convert {
5845#define BPF_PROG_TYPE(_id, _name, prog_ctx_type, kern_ctx_type) \
5846	prog_ctx_type _id##_prog; \
5847	kern_ctx_type _id##_kern;
5848#include <linux/bpf_types.h>
5849#undef BPF_PROG_TYPE
5850	} *__t;
5851	/* 't' is written once under lock. Read many times. */
5852	const struct btf_type *t;
5853} bpf_ctx_convert;
5854enum {
5855#define BPF_PROG_TYPE(_id, _name, prog_ctx_type, kern_ctx_type) \
5856	__ctx_convert##_id,
5857#include <linux/bpf_types.h>
5858#undef BPF_PROG_TYPE
5859	__ctx_convert_unused, /* to avoid empty enum in extreme .config */
5860};
5861static u8 bpf_ctx_convert_map[] = {
5862#define BPF_PROG_TYPE(_id, _name, prog_ctx_type, kern_ctx_type) \
5863	[_id] = __ctx_convert##_id,
5864#include <linux/bpf_types.h>
5865#undef BPF_PROG_TYPE
5866	0, /* avoid empty array */
5867};
5868#undef BPF_MAP_TYPE
5869#undef BPF_LINK_TYPE
5870
5871static const struct btf_type *find_canonical_prog_ctx_type(enum bpf_prog_type prog_type)
 
 
 
5872{
5873	const struct btf_type *conv_struct;
 
5874	const struct btf_member *ctx_type;
 
5875
5876	conv_struct = bpf_ctx_convert.t;
5877	if (!conv_struct)
 
5878		return NULL;
5879	/* prog_type is valid bpf program type. No need for bounds check. */
5880	ctx_type = btf_type_member(conv_struct) + bpf_ctx_convert_map[prog_type] * 2;
5881	/* ctx_type is a pointer to prog_ctx_type in vmlinux.
5882	 * Like 'struct __sk_buff'
5883	 */
5884	return btf_type_by_id(btf_vmlinux, ctx_type->type);
5885}
5886
5887static int find_kern_ctx_type_id(enum bpf_prog_type prog_type)
5888{
5889	const struct btf_type *conv_struct;
5890	const struct btf_member *ctx_type;
5891
5892	conv_struct = bpf_ctx_convert.t;
5893	if (!conv_struct)
5894		return -EFAULT;
5895	/* prog_type is valid bpf program type. No need for bounds check. */
5896	ctx_type = btf_type_member(conv_struct) + bpf_ctx_convert_map[prog_type] * 2 + 1;
5897	/* ctx_type is a pointer to prog_ctx_type in vmlinux.
5898	 * Like 'struct sk_buff'
5899	 */
5900	return ctx_type->type;
5901}
5902
5903bool btf_is_projection_of(const char *pname, const char *tname)
5904{
5905	if (strcmp(pname, "__sk_buff") == 0 && strcmp(tname, "sk_buff") == 0)
5906		return true;
5907	if (strcmp(pname, "xdp_md") == 0 && strcmp(tname, "xdp_buff") == 0)
5908		return true;
5909	return false;
5910}
5911
5912bool btf_is_prog_ctx_type(struct bpf_verifier_log *log, const struct btf *btf,
5913			  const struct btf_type *t, enum bpf_prog_type prog_type,
5914			  int arg)
5915{
5916	const struct btf_type *ctx_type;
5917	const char *tname, *ctx_tname;
5918
5919	t = btf_type_by_id(btf, t->type);
5920
5921	/* KPROBE programs allow bpf_user_pt_regs_t typedef, which we need to
5922	 * check before we skip all the typedef below.
5923	 */
5924	if (prog_type == BPF_PROG_TYPE_KPROBE) {
5925		while (btf_type_is_modifier(t) && !btf_type_is_typedef(t))
5926			t = btf_type_by_id(btf, t->type);
5927
5928		if (btf_type_is_typedef(t)) {
5929			tname = btf_name_by_offset(btf, t->name_off);
5930			if (tname && strcmp(tname, "bpf_user_pt_regs_t") == 0)
5931				return true;
5932		}
5933	}
5934
5935	while (btf_type_is_modifier(t))
5936		t = btf_type_by_id(btf, t->type);
5937	if (!btf_type_is_struct(t)) {
5938		/* Only pointer to struct is supported for now.
5939		 * That means that BPF_PROG_TYPE_TRACEPOINT with BTF
5940		 * is not supported yet.
5941		 * BPF_PROG_TYPE_RAW_TRACEPOINT is fine.
5942		 */
5943		return false;
5944	}
5945	tname = btf_name_by_offset(btf, t->name_off);
5946	if (!tname) {
5947		bpf_log(log, "arg#%d struct doesn't have a name\n", arg);
5948		return false;
5949	}
5950
5951	ctx_type = find_canonical_prog_ctx_type(prog_type);
5952	if (!ctx_type) {
5953		bpf_log(log, "btf_vmlinux is malformed\n");
 
 
 
5954		/* should not happen */
5955		return false;
5956	}
5957again:
5958	ctx_tname = btf_name_by_offset(btf_vmlinux, ctx_type->name_off);
5959	if (!ctx_tname) {
5960		/* should not happen */
5961		bpf_log(log, "Please fix kernel include/linux/bpf_types.h\n");
5962		return false;
5963	}
5964	/* program types without named context types work only with arg:ctx tag */
5965	if (ctx_tname[0] == '\0')
5966		return false;
5967	/* only compare that prog's ctx type name is the same as
5968	 * kernel expects. No need to compare field by field.
5969	 * It's ok for bpf prog to do:
5970	 * struct __sk_buff {};
5971	 * int socket_filter_bpf_prog(struct __sk_buff *skb)
5972	 * { // no fields of skb are ever used }
5973	 */
5974	if (btf_is_projection_of(ctx_tname, tname))
5975		return true;
5976	if (strcmp(ctx_tname, tname)) {
5977		/* bpf_user_pt_regs_t is a typedef, so resolve it to
5978		 * underlying struct and check name again
5979		 */
5980		if (!btf_type_is_modifier(ctx_type))
5981			return false;
5982		while (btf_type_is_modifier(ctx_type))
5983			ctx_type = btf_type_by_id(btf_vmlinux, ctx_type->type);
5984		goto again;
5985	}
5986	return true;
5987}
5988
5989/* forward declarations for arch-specific underlying types of
5990 * bpf_user_pt_regs_t; this avoids the need for arch-specific #ifdef
5991 * compilation guards below for BPF_PROG_TYPE_PERF_EVENT checks, but still
5992 * works correctly with __builtin_types_compatible_p() on respective
5993 * architectures
5994 */
5995struct user_regs_struct;
5996struct user_pt_regs;
5997
5998static int btf_validate_prog_ctx_type(struct bpf_verifier_log *log, const struct btf *btf,
5999				      const struct btf_type *t, int arg,
6000				      enum bpf_prog_type prog_type,
6001				      enum bpf_attach_type attach_type)
6002{
6003	const struct btf_type *ctx_type;
6004	const char *tname, *ctx_tname;
6005
6006	if (!btf_is_ptr(t)) {
6007		bpf_log(log, "arg#%d type isn't a pointer\n", arg);
6008		return -EINVAL;
6009	}
6010	t = btf_type_by_id(btf, t->type);
6011
6012	/* KPROBE and PERF_EVENT programs allow bpf_user_pt_regs_t typedef */
6013	if (prog_type == BPF_PROG_TYPE_KPROBE || prog_type == BPF_PROG_TYPE_PERF_EVENT) {
6014		while (btf_type_is_modifier(t) && !btf_type_is_typedef(t))
6015			t = btf_type_by_id(btf, t->type);
6016
6017		if (btf_type_is_typedef(t)) {
6018			tname = btf_name_by_offset(btf, t->name_off);
6019			if (tname && strcmp(tname, "bpf_user_pt_regs_t") == 0)
6020				return 0;
6021		}
6022	}
6023
6024	/* all other program types don't use typedefs for context type */
6025	while (btf_type_is_modifier(t))
6026		t = btf_type_by_id(btf, t->type);
6027
6028	/* `void *ctx __arg_ctx` is always valid */
6029	if (btf_type_is_void(t))
6030		return 0;
6031
6032	tname = btf_name_by_offset(btf, t->name_off);
6033	if (str_is_empty(tname)) {
6034		bpf_log(log, "arg#%d type doesn't have a name\n", arg);
6035		return -EINVAL;
6036	}
6037
6038	/* special cases */
6039	switch (prog_type) {
6040	case BPF_PROG_TYPE_KPROBE:
6041		if (__btf_type_is_struct(t) && strcmp(tname, "pt_regs") == 0)
6042			return 0;
6043		break;
6044	case BPF_PROG_TYPE_PERF_EVENT:
6045		if (__builtin_types_compatible_p(bpf_user_pt_regs_t, struct pt_regs) &&
6046		    __btf_type_is_struct(t) && strcmp(tname, "pt_regs") == 0)
6047			return 0;
6048		if (__builtin_types_compatible_p(bpf_user_pt_regs_t, struct user_pt_regs) &&
6049		    __btf_type_is_struct(t) && strcmp(tname, "user_pt_regs") == 0)
6050			return 0;
6051		if (__builtin_types_compatible_p(bpf_user_pt_regs_t, struct user_regs_struct) &&
6052		    __btf_type_is_struct(t) && strcmp(tname, "user_regs_struct") == 0)
6053			return 0;
6054		break;
6055	case BPF_PROG_TYPE_RAW_TRACEPOINT:
6056	case BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE:
6057		/* allow u64* as ctx */
6058		if (btf_is_int(t) && t->size == 8)
6059			return 0;
6060		break;
6061	case BPF_PROG_TYPE_TRACING:
6062		switch (attach_type) {
6063		case BPF_TRACE_RAW_TP:
6064			/* tp_btf program is TRACING, so need special case here */
6065			if (__btf_type_is_struct(t) &&
6066			    strcmp(tname, "bpf_raw_tracepoint_args") == 0)
6067				return 0;
6068			/* allow u64* as ctx */
6069			if (btf_is_int(t) && t->size == 8)
6070				return 0;
6071			break;
6072		case BPF_TRACE_ITER:
6073			/* allow struct bpf_iter__xxx types only */
6074			if (__btf_type_is_struct(t) &&
6075			    strncmp(tname, "bpf_iter__", sizeof("bpf_iter__") - 1) == 0)
6076				return 0;
6077			break;
6078		case BPF_TRACE_FENTRY:
6079		case BPF_TRACE_FEXIT:
6080		case BPF_MODIFY_RETURN:
6081			/* allow u64* as ctx */
6082			if (btf_is_int(t) && t->size == 8)
6083				return 0;
6084			break;
6085		default:
6086			break;
6087		}
6088		break;
6089	case BPF_PROG_TYPE_LSM:
6090	case BPF_PROG_TYPE_STRUCT_OPS:
6091		/* allow u64* as ctx */
6092		if (btf_is_int(t) && t->size == 8)
6093			return 0;
6094		break;
6095	case BPF_PROG_TYPE_TRACEPOINT:
6096	case BPF_PROG_TYPE_SYSCALL:
6097	case BPF_PROG_TYPE_EXT:
6098		return 0; /* anything goes */
6099	default:
6100		break;
6101	}
6102
6103	ctx_type = find_canonical_prog_ctx_type(prog_type);
6104	if (!ctx_type) {
6105		/* should not happen */
6106		bpf_log(log, "btf_vmlinux is malformed\n");
6107		return -EINVAL;
6108	}
6109
6110	/* resolve typedefs and check that underlying structs are matching as well */
6111	while (btf_type_is_modifier(ctx_type))
6112		ctx_type = btf_type_by_id(btf_vmlinux, ctx_type->type);
6113
6114	/* if program type doesn't have distinctly named struct type for
6115	 * context, then __arg_ctx argument can only be `void *`, which we
6116	 * already checked above
6117	 */
6118	if (!__btf_type_is_struct(ctx_type)) {
6119		bpf_log(log, "arg#%d should be void pointer\n", arg);
6120		return -EINVAL;
6121	}
6122
6123	ctx_tname = btf_name_by_offset(btf_vmlinux, ctx_type->name_off);
6124	if (!__btf_type_is_struct(t) || strcmp(ctx_tname, tname) != 0) {
6125		bpf_log(log, "arg#%d should be `struct %s *`\n", arg, ctx_tname);
6126		return -EINVAL;
6127	}
6128
6129	return 0;
6130}
6131
6132static int btf_translate_to_vmlinux(struct bpf_verifier_log *log,
6133				     struct btf *btf,
6134				     const struct btf_type *t,
6135				     enum bpf_prog_type prog_type,
6136				     int arg)
6137{
6138	if (!btf_is_prog_ctx_type(log, btf, t, prog_type, arg))
 
 
 
6139		return -ENOENT;
6140	return find_kern_ctx_type_id(prog_type);
 
6141}
6142
6143int get_kern_ctx_btf_id(struct bpf_verifier_log *log, enum bpf_prog_type prog_type)
6144{
6145	const struct btf_member *kctx_member;
6146	const struct btf_type *conv_struct;
6147	const struct btf_type *kctx_type;
6148	u32 kctx_type_id;
6149
6150	conv_struct = bpf_ctx_convert.t;
6151	/* get member for kernel ctx type */
6152	kctx_member = btf_type_member(conv_struct) + bpf_ctx_convert_map[prog_type] * 2 + 1;
6153	kctx_type_id = kctx_member->type;
6154	kctx_type = btf_type_by_id(btf_vmlinux, kctx_type_id);
6155	if (!btf_type_is_struct(kctx_type)) {
6156		bpf_log(log, "kern ctx type id %u is not a struct\n", kctx_type_id);
6157		return -EINVAL;
6158	}
6159
6160	return kctx_type_id;
6161}
6162
6163BTF_ID_LIST(bpf_ctx_convert_btf_id)
6164BTF_ID(struct, bpf_ctx_convert)
6165
6166static struct btf *btf_parse_base(struct btf_verifier_env *env, const char *name,
6167				  void *data, unsigned int data_size)
6168{
 
 
6169	struct btf *btf = NULL;
6170	int err;
6171
6172	if (!IS_ENABLED(CONFIG_DEBUG_INFO_BTF))
6173		return ERR_PTR(-ENOENT);
 
 
 
 
6174
6175	btf = kzalloc(sizeof(*btf), GFP_KERNEL | __GFP_NOWARN);
6176	if (!btf) {
6177		err = -ENOMEM;
6178		goto errout;
6179	}
6180	env->btf = btf;
6181
6182	btf->data = data;
6183	btf->data_size = data_size;
6184	btf->kernel_btf = true;
6185	snprintf(btf->name, sizeof(btf->name), "%s", name);
6186
6187	err = btf_parse_hdr(env);
6188	if (err)
6189		goto errout;
6190
6191	btf->nohdr_data = btf->data + btf->hdr.hdr_len;
6192
6193	err = btf_parse_str_sec(env);
6194	if (err)
6195		goto errout;
6196
6197	err = btf_check_all_metas(env);
6198	if (err)
6199		goto errout;
6200
6201	err = btf_check_type_tags(env, btf, 1);
6202	if (err)
6203		goto errout;
6204
 
 
 
 
 
6205	refcount_set(&btf->refcnt, 1);
6206
 
 
 
 
 
6207	return btf;
6208
6209errout:
 
6210	if (btf) {
6211		kvfree(btf->types);
6212		kfree(btf);
6213	}
6214	return ERR_PTR(err);
6215}
6216
6217struct btf *btf_parse_vmlinux(void)
6218{
6219	struct btf_verifier_env *env = NULL;
6220	struct bpf_verifier_log *log;
6221	struct btf *btf;
6222	int err;
6223
6224	env = kzalloc(sizeof(*env), GFP_KERNEL | __GFP_NOWARN);
6225	if (!env)
6226		return ERR_PTR(-ENOMEM);
6227
6228	log = &env->log;
6229	log->level = BPF_LOG_KERNEL;
6230	btf = btf_parse_base(env, "vmlinux", __start_BTF, __stop_BTF - __start_BTF);
6231	if (IS_ERR(btf))
6232		goto err_out;
6233
6234	/* btf_parse_vmlinux() runs under bpf_verifier_lock */
6235	bpf_ctx_convert.t = btf_type_by_id(btf, bpf_ctx_convert_btf_id[0]);
6236	err = btf_alloc_id(btf);
6237	if (err) {
6238		btf_free(btf);
6239		btf = ERR_PTR(err);
6240	}
6241err_out:
6242	btf_verifier_env_free(env);
6243	return btf;
6244}
6245
6246/* If .BTF_ids section was created with distilled base BTF, both base and
6247 * split BTF ids will need to be mapped to actual base/split ids for
6248 * BTF now that it has been relocated.
6249 */
6250static __u32 btf_relocate_id(const struct btf *btf, __u32 id)
6251{
6252	if (!btf->base_btf || !btf->base_id_map)
6253		return id;
6254	return btf->base_id_map[id];
6255}
6256
6257#ifdef CONFIG_DEBUG_INFO_BTF_MODULES
6258
6259static struct btf *btf_parse_module(const char *module_name, const void *data,
6260				    unsigned int data_size, void *base_data,
6261				    unsigned int base_data_size)
6262{
6263	struct btf *btf = NULL, *vmlinux_btf, *base_btf = NULL;
6264	struct btf_verifier_env *env = NULL;
6265	struct bpf_verifier_log *log;
6266	int err = 0;
 
6267
6268	vmlinux_btf = bpf_get_btf_vmlinux();
6269	if (IS_ERR(vmlinux_btf))
6270		return vmlinux_btf;
6271	if (!vmlinux_btf)
6272		return ERR_PTR(-EINVAL);
6273
6274	env = kzalloc(sizeof(*env), GFP_KERNEL | __GFP_NOWARN);
6275	if (!env)
6276		return ERR_PTR(-ENOMEM);
6277
6278	log = &env->log;
6279	log->level = BPF_LOG_KERNEL;
6280
6281	if (base_data) {
6282		base_btf = btf_parse_base(env, ".BTF.base", base_data, base_data_size);
6283		if (IS_ERR(base_btf)) {
6284			err = PTR_ERR(base_btf);
6285			goto errout;
6286		}
6287	} else {
6288		base_btf = vmlinux_btf;
6289	}
6290
6291	btf = kzalloc(sizeof(*btf), GFP_KERNEL | __GFP_NOWARN);
6292	if (!btf) {
6293		err = -ENOMEM;
6294		goto errout;
6295	}
6296	env->btf = btf;
6297
6298	btf->base_btf = base_btf;
6299	btf->start_id = base_btf->nr_types;
6300	btf->start_str_off = base_btf->hdr.str_len;
6301	btf->kernel_btf = true;
6302	snprintf(btf->name, sizeof(btf->name), "%s", module_name);
6303
6304	btf->data = kvmemdup(data, data_size, GFP_KERNEL | __GFP_NOWARN);
6305	if (!btf->data) {
6306		err = -ENOMEM;
6307		goto errout;
6308	}
 
6309	btf->data_size = data_size;
6310
6311	err = btf_parse_hdr(env);
6312	if (err)
6313		goto errout;
6314
6315	btf->nohdr_data = btf->data + btf->hdr.hdr_len;
6316
6317	err = btf_parse_str_sec(env);
6318	if (err)
6319		goto errout;
6320
6321	err = btf_check_all_metas(env);
6322	if (err)
6323		goto errout;
6324
6325	err = btf_check_type_tags(env, btf, btf_nr_types(base_btf));
6326	if (err)
6327		goto errout;
6328
6329	if (base_btf != vmlinux_btf) {
6330		err = btf_relocate(btf, vmlinux_btf, &btf->base_id_map);
6331		if (err)
6332			goto errout;
6333		btf_free(base_btf);
6334		base_btf = vmlinux_btf;
6335	}
6336
6337	btf_verifier_env_free(env);
6338	refcount_set(&btf->refcnt, 1);
6339	return btf;
6340
6341errout:
6342	btf_verifier_env_free(env);
6343	if (!IS_ERR(base_btf) && base_btf != vmlinux_btf)
6344		btf_free(base_btf);
6345	if (btf) {
6346		kvfree(btf->data);
6347		kvfree(btf->types);
6348		kfree(btf);
6349	}
6350	return ERR_PTR(err);
6351}
6352
6353#endif /* CONFIG_DEBUG_INFO_BTF_MODULES */
6354
6355struct btf *bpf_prog_get_target_btf(const struct bpf_prog *prog)
6356{
6357	struct bpf_prog *tgt_prog = prog->aux->dst_prog;
6358
6359	if (tgt_prog)
6360		return tgt_prog->aux->btf;
6361	else
6362		return prog->aux->attach_btf;
6363}
6364
6365static bool is_int_ptr(struct btf *btf, const struct btf_type *t)
6366{
6367	/* skip modifiers */
6368	t = btf_type_skip_modifiers(btf, t->type, NULL);
 
 
 
 
6369
6370	return btf_type_is_int(t);
6371}
6372
6373static u32 get_ctx_arg_idx(struct btf *btf, const struct btf_type *func_proto,
6374			   int off)
6375{
6376	const struct btf_param *args;
6377	const struct btf_type *t;
6378	u32 offset = 0, nr_args;
6379	int i;
6380
6381	if (!func_proto)
6382		return off / 8;
6383
6384	nr_args = btf_type_vlen(func_proto);
6385	args = (const struct btf_param *)(func_proto + 1);
6386	for (i = 0; i < nr_args; i++) {
6387		t = btf_type_skip_modifiers(btf, args[i].type, NULL);
6388		offset += btf_type_is_ptr(t) ? 8 : roundup(t->size, 8);
6389		if (off < offset)
6390			return i;
6391	}
6392
6393	t = btf_type_skip_modifiers(btf, func_proto->type, NULL);
6394	offset += btf_type_is_ptr(t) ? 8 : roundup(t->size, 8);
6395	if (off < offset)
6396		return nr_args;
6397
6398	return nr_args + 1;
6399}
6400
6401static bool prog_args_trusted(const struct bpf_prog *prog)
6402{
6403	enum bpf_attach_type atype = prog->expected_attach_type;
6404
6405	switch (prog->type) {
6406	case BPF_PROG_TYPE_TRACING:
6407		return atype == BPF_TRACE_RAW_TP || atype == BPF_TRACE_ITER;
6408	case BPF_PROG_TYPE_LSM:
6409		return bpf_lsm_is_trusted(prog);
6410	case BPF_PROG_TYPE_STRUCT_OPS:
6411		return true;
6412	default:
6413		return false;
6414	}
6415}
6416
6417int btf_ctx_arg_offset(const struct btf *btf, const struct btf_type *func_proto,
6418		       u32 arg_no)
6419{
6420	const struct btf_param *args;
6421	const struct btf_type *t;
6422	int off = 0, i;
6423	u32 sz;
6424
6425	args = btf_params(func_proto);
6426	for (i = 0; i < arg_no; i++) {
6427		t = btf_type_by_id(btf, args[i].type);
6428		t = btf_resolve_size(btf, t, &sz);
6429		if (IS_ERR(t))
6430			return PTR_ERR(t);
6431		off += roundup(sz, 8);
6432	}
6433
6434	return off;
6435}
6436
6437struct bpf_raw_tp_null_args {
6438	const char *func;
6439	u64 mask;
6440};
6441
6442static const struct bpf_raw_tp_null_args raw_tp_null_args[] = {
6443	/* sched */
6444	{ "sched_pi_setprio", 0x10 },
6445	/* ... from sched_numa_pair_template event class */
6446	{ "sched_stick_numa", 0x100 },
6447	{ "sched_swap_numa", 0x100 },
6448	/* afs */
6449	{ "afs_make_fs_call", 0x10 },
6450	{ "afs_make_fs_calli", 0x10 },
6451	{ "afs_make_fs_call1", 0x10 },
6452	{ "afs_make_fs_call2", 0x10 },
6453	{ "afs_protocol_error", 0x1 },
6454	{ "afs_flock_ev", 0x10 },
6455	/* cachefiles */
6456	{ "cachefiles_lookup", 0x1 | 0x200 },
6457	{ "cachefiles_unlink", 0x1 },
6458	{ "cachefiles_rename", 0x1 },
6459	{ "cachefiles_prep_read", 0x1 },
6460	{ "cachefiles_mark_active", 0x1 },
6461	{ "cachefiles_mark_failed", 0x1 },
6462	{ "cachefiles_mark_inactive", 0x1 },
6463	{ "cachefiles_vfs_error", 0x1 },
6464	{ "cachefiles_io_error", 0x1 },
6465	{ "cachefiles_ondemand_open", 0x1 },
6466	{ "cachefiles_ondemand_copen", 0x1 },
6467	{ "cachefiles_ondemand_close", 0x1 },
6468	{ "cachefiles_ondemand_read", 0x1 },
6469	{ "cachefiles_ondemand_cread", 0x1 },
6470	{ "cachefiles_ondemand_fd_write", 0x1 },
6471	{ "cachefiles_ondemand_fd_release", 0x1 },
6472	/* ext4, from ext4__mballoc event class */
6473	{ "ext4_mballoc_discard", 0x10 },
6474	{ "ext4_mballoc_free", 0x10 },
6475	/* fib */
6476	{ "fib_table_lookup", 0x100 },
6477	/* filelock */
6478	/* ... from filelock_lock event class */
6479	{ "posix_lock_inode", 0x10 },
6480	{ "fcntl_setlk", 0x10 },
6481	{ "locks_remove_posix", 0x10 },
6482	{ "flock_lock_inode", 0x10 },
6483	/* ... from filelock_lease event class */
6484	{ "break_lease_noblock", 0x10 },
6485	{ "break_lease_block", 0x10 },
6486	{ "break_lease_unblock", 0x10 },
6487	{ "generic_delete_lease", 0x10 },
6488	{ "time_out_leases", 0x10 },
6489	/* host1x */
6490	{ "host1x_cdma_push_gather", 0x10000 },
6491	/* huge_memory */
6492	{ "mm_khugepaged_scan_pmd", 0x10 },
6493	{ "mm_collapse_huge_page_isolate", 0x1 },
6494	{ "mm_khugepaged_scan_file", 0x10 },
6495	{ "mm_khugepaged_collapse_file", 0x10 },
6496	/* kmem */
6497	{ "mm_page_alloc", 0x1 },
6498	{ "mm_page_pcpu_drain", 0x1 },
6499	/* .. from mm_page event class */
6500	{ "mm_page_alloc_zone_locked", 0x1 },
6501	/* netfs */
6502	{ "netfs_failure", 0x10 },
6503	/* power */
6504	{ "device_pm_callback_start", 0x10 },
6505	/* qdisc */
6506	{ "qdisc_dequeue", 0x1000 },
6507	/* rxrpc */
6508	{ "rxrpc_recvdata", 0x1 },
6509	{ "rxrpc_resend", 0x10 },
6510	/* skb */
6511	{"kfree_skb", 0x1000},
6512	/* sunrpc */
6513	{ "xs_stream_read_data", 0x1 },
6514	/* ... from xprt_cong_event event class */
6515	{ "xprt_reserve_cong", 0x10 },
6516	{ "xprt_release_cong", 0x10 },
6517	{ "xprt_get_cong", 0x10 },
6518	{ "xprt_put_cong", 0x10 },
6519	/* tcp */
6520	{ "tcp_send_reset", 0x11 },
6521	/* tegra_apb_dma */
6522	{ "tegra_dma_tx_status", 0x100 },
6523	/* timer_migration */
6524	{ "tmigr_update_events", 0x1 },
6525	/* writeback, from writeback_folio_template event class */
6526	{ "writeback_dirty_folio", 0x10 },
6527	{ "folio_wait_writeback", 0x10 },
6528	/* rdma */
6529	{ "mr_integ_alloc", 0x2000 },
6530	/* bpf_testmod */
6531	{ "bpf_testmod_test_read", 0x0 },
6532};
6533
6534bool btf_ctx_access(int off, int size, enum bpf_access_type type,
6535		    const struct bpf_prog *prog,
6536		    struct bpf_insn_access_aux *info)
6537{
6538	const struct btf_type *t = prog->aux->attach_func_proto;
6539	struct bpf_prog *tgt_prog = prog->aux->dst_prog;
6540	struct btf *btf = bpf_prog_get_target_btf(prog);
6541	const char *tname = prog->aux->attach_func_name;
6542	struct bpf_verifier_log *log = info->log;
6543	const struct btf_param *args;
6544	bool ptr_err_raw_tp = false;
6545	const char *tag_value;
6546	u32 nr_args, arg;
6547	int i, ret;
6548
6549	if (off % 8) {
6550		bpf_log(log, "func '%s' offset %d is not multiple of 8\n",
6551			tname, off);
6552		return false;
6553	}
6554	arg = get_ctx_arg_idx(btf, t, off);
6555	args = (const struct btf_param *)(t + 1);
6556	/* if (t == NULL) Fall back to default BPF prog with
6557	 * MAX_BPF_FUNC_REG_ARGS u64 arguments.
6558	 */
6559	nr_args = t ? btf_type_vlen(t) : MAX_BPF_FUNC_REG_ARGS;
6560	if (prog->aux->attach_btf_trace) {
6561		/* skip first 'void *__data' argument in btf_trace_##name typedef */
6562		args++;
6563		nr_args--;
6564	}
6565
6566	if (arg > nr_args) {
6567		bpf_log(log, "func '%s' doesn't have %d-th argument\n",
6568			tname, arg + 1);
6569		return false;
6570	}
6571
6572	if (arg == nr_args) {
6573		switch (prog->expected_attach_type) {
 
6574		case BPF_LSM_MAC:
6575			/* mark we are accessing the return value */
6576			info->is_retval = true;
6577			fallthrough;
6578		case BPF_LSM_CGROUP:
6579		case BPF_TRACE_FEXIT:
6580			/* When LSM programs are attached to void LSM hooks
6581			 * they use FEXIT trampolines and when attached to
6582			 * int LSM hooks, they use MODIFY_RETURN trampolines.
6583			 *
6584			 * While the LSM programs are BPF_MODIFY_RETURN-like
6585			 * the check:
6586			 *
6587			 *	if (ret_type != 'int')
6588			 *		return -EINVAL;
6589			 *
6590			 * is _not_ done here. This is still safe as LSM hooks
6591			 * have only void and int return types.
6592			 */
6593			if (!t)
6594				return true;
6595			t = btf_type_by_id(btf, t->type);
6596			break;
6597		case BPF_MODIFY_RETURN:
6598			/* For now the BPF_MODIFY_RETURN can only be attached to
6599			 * functions that return an int.
6600			 */
6601			if (!t)
6602				return false;
6603
6604			t = btf_type_skip_modifiers(btf, t->type, NULL);
6605			if (!btf_type_is_small_int(t)) {
6606				bpf_log(log,
6607					"ret type %s not allowed for fmod_ret\n",
6608					btf_type_str(t));
6609				return false;
6610			}
6611			break;
6612		default:
6613			bpf_log(log, "func '%s' doesn't have %d-th argument\n",
6614				tname, arg + 1);
6615			return false;
6616		}
6617	} else {
6618		if (!t)
6619			/* Default prog with MAX_BPF_FUNC_REG_ARGS args */
6620			return true;
6621		t = btf_type_by_id(btf, args[arg].type);
6622	}
6623
6624	/* skip modifiers */
6625	while (btf_type_is_modifier(t))
6626		t = btf_type_by_id(btf, t->type);
6627	if (btf_type_is_small_int(t) || btf_is_any_enum(t) || __btf_type_is_struct(t))
6628		/* accessing a scalar */
6629		return true;
6630	if (!btf_type_is_ptr(t)) {
6631		bpf_log(log,
6632			"func '%s' arg%d '%s' has type %s. Only pointer access is allowed\n",
6633			tname, arg,
6634			__btf_name_by_offset(btf, t->name_off),
6635			btf_type_str(t));
6636		return false;
6637	}
6638
6639	if (size != sizeof(u64)) {
6640		bpf_log(log, "func '%s' size %d must be 8\n",
6641			tname, size);
6642		return false;
6643	}
6644
6645	/* check for PTR_TO_RDONLY_BUF_OR_NULL or PTR_TO_RDWR_BUF_OR_NULL */
6646	for (i = 0; i < prog->aux->ctx_arg_info_size; i++) {
6647		const struct bpf_ctx_arg_aux *ctx_arg_info = &prog->aux->ctx_arg_info[i];
6648		u32 type, flag;
6649
6650		type = base_type(ctx_arg_info->reg_type);
6651		flag = type_flag(ctx_arg_info->reg_type);
6652		if (ctx_arg_info->offset == off && type == PTR_TO_BUF &&
6653		    (flag & PTR_MAYBE_NULL)) {
6654			info->reg_type = ctx_arg_info->reg_type;
6655			return true;
6656		}
6657	}
6658
6659	if (t->type == 0)
6660		/* This is a pointer to void.
6661		 * It is the same as scalar from the verifier safety pov.
6662		 * No further pointer walking is allowed.
6663		 */
6664		return true;
6665
6666	if (is_int_ptr(btf, t))
6667		return true;
6668
6669	/* this is a pointer to another type */
6670	for (i = 0; i < prog->aux->ctx_arg_info_size; i++) {
6671		const struct bpf_ctx_arg_aux *ctx_arg_info = &prog->aux->ctx_arg_info[i];
6672
6673		if (ctx_arg_info->offset == off) {
6674			if (!ctx_arg_info->btf_id) {
6675				bpf_log(log,"invalid btf_id for context argument offset %u\n", off);
6676				return false;
6677			}
6678
6679			info->reg_type = ctx_arg_info->reg_type;
6680			info->btf = ctx_arg_info->btf ? : btf_vmlinux;
6681			info->btf_id = ctx_arg_info->btf_id;
6682			return true;
6683		}
6684	}
6685
6686	info->reg_type = PTR_TO_BTF_ID;
6687	if (prog_args_trusted(prog))
6688		info->reg_type |= PTR_TRUSTED;
6689
6690	if (btf_param_match_suffix(btf, &args[arg], "__nullable"))
6691		info->reg_type |= PTR_MAYBE_NULL;
6692
6693	if (prog->expected_attach_type == BPF_TRACE_RAW_TP) {
6694		struct btf *btf = prog->aux->attach_btf;
6695		const struct btf_type *t;
6696		const char *tname;
6697
6698		/* BTF lookups cannot fail, return false on error */
6699		t = btf_type_by_id(btf, prog->aux->attach_btf_id);
6700		if (!t)
6701			return false;
6702		tname = btf_name_by_offset(btf, t->name_off);
6703		if (!tname)
6704			return false;
6705		/* Checked by bpf_check_attach_target */
6706		tname += sizeof("btf_trace_") - 1;
6707		for (i = 0; i < ARRAY_SIZE(raw_tp_null_args); i++) {
6708			/* Is this a func with potential NULL args? */
6709			if (strcmp(tname, raw_tp_null_args[i].func))
6710				continue;
6711			if (raw_tp_null_args[i].mask & (0x1 << (arg * 4)))
6712				info->reg_type |= PTR_MAYBE_NULL;
6713			/* Is the current arg IS_ERR? */
6714			if (raw_tp_null_args[i].mask & (0x2 << (arg * 4)))
6715				ptr_err_raw_tp = true;
6716			break;
6717		}
6718		/* If we don't know NULL-ness specification and the tracepoint
6719		 * is coming from a loadable module, be conservative and mark
6720		 * argument as PTR_MAYBE_NULL.
6721		 */
6722		if (i == ARRAY_SIZE(raw_tp_null_args) && btf_is_module(btf))
6723			info->reg_type |= PTR_MAYBE_NULL;
6724	}
6725
6726	if (tgt_prog) {
6727		enum bpf_prog_type tgt_type;
6728
6729		if (tgt_prog->type == BPF_PROG_TYPE_EXT)
6730			tgt_type = tgt_prog->aux->saved_dst_prog_type;
6731		else
6732			tgt_type = tgt_prog->type;
6733
6734		ret = btf_translate_to_vmlinux(log, btf, t, tgt_type, arg);
6735		if (ret > 0) {
6736			info->btf = btf_vmlinux;
6737			info->btf_id = ret;
6738			return true;
6739		} else {
6740			return false;
6741		}
6742	}
6743
6744	info->btf = btf;
6745	info->btf_id = t->type;
6746	t = btf_type_by_id(btf, t->type);
6747
6748	if (btf_type_is_type_tag(t)) {
6749		tag_value = __btf_name_by_offset(btf, t->name_off);
6750		if (strcmp(tag_value, "user") == 0)
6751			info->reg_type |= MEM_USER;
6752		if (strcmp(tag_value, "percpu") == 0)
6753			info->reg_type |= MEM_PERCPU;
6754	}
6755
6756	/* skip modifiers */
6757	while (btf_type_is_modifier(t)) {
6758		info->btf_id = t->type;
6759		t = btf_type_by_id(btf, t->type);
6760	}
6761	if (!btf_type_is_struct(t)) {
6762		bpf_log(log,
6763			"func '%s' arg%d type %s is not a struct\n",
6764			tname, arg, btf_type_str(t));
6765		return false;
6766	}
6767	bpf_log(log, "func '%s' arg%d has btf_id %d type %s '%s'\n",
6768		tname, arg, info->btf_id, btf_type_str(t),
6769		__btf_name_by_offset(btf, t->name_off));
6770
6771	/* Perform all checks on the validity of type for this argument, but if
6772	 * we know it can be IS_ERR at runtime, scrub pointer type and mark as
6773	 * scalar.
6774	 */
6775	if (ptr_err_raw_tp) {
6776		bpf_log(log, "marking pointer arg%d as scalar as it may encode error", arg);
6777		info->reg_type = SCALAR_VALUE;
6778	}
6779	return true;
6780}
6781EXPORT_SYMBOL_GPL(btf_ctx_access);
6782
6783enum bpf_struct_walk_result {
6784	/* < 0 error */
6785	WALK_SCALAR = 0,
6786	WALK_PTR,
6787	WALK_STRUCT,
6788};
6789
6790static int btf_struct_walk(struct bpf_verifier_log *log, const struct btf *btf,
6791			   const struct btf_type *t, int off, int size,
6792			   u32 *next_btf_id, enum bpf_type_flag *flag,
6793			   const char **field_name)
6794{
6795	u32 i, moff, mtrue_end, msize = 0, total_nelems = 0;
6796	const struct btf_type *mtype, *elem_type = NULL;
6797	const struct btf_member *member;
6798	const char *tname, *mname, *tag_value;
6799	u32 vlen, elem_id, mid;
6800
6801again:
6802	if (btf_type_is_modifier(t))
6803		t = btf_type_skip_modifiers(btf, t->type, NULL);
6804	tname = __btf_name_by_offset(btf, t->name_off);
6805	if (!btf_type_is_struct(t)) {
6806		bpf_log(log, "Type '%s' is not a struct\n", tname);
6807		return -EINVAL;
6808	}
6809
6810	vlen = btf_type_vlen(t);
6811	if (BTF_INFO_KIND(t->info) == BTF_KIND_UNION && vlen != 1 && !(*flag & PTR_UNTRUSTED))
6812		/*
6813		 * walking unions yields untrusted pointers
6814		 * with exception of __bpf_md_ptr and other
6815		 * unions with a single member
6816		 */
6817		*flag |= PTR_UNTRUSTED;
6818
6819	if (off + size > t->size) {
6820		/* If the last element is a variable size array, we may
6821		 * need to relax the rule.
6822		 */
6823		struct btf_array *array_elem;
6824
6825		if (vlen == 0)
6826			goto error;
6827
6828		member = btf_type_member(t) + vlen - 1;
6829		mtype = btf_type_skip_modifiers(btf, member->type,
6830						NULL);
6831		if (!btf_type_is_array(mtype))
6832			goto error;
6833
6834		array_elem = (struct btf_array *)(mtype + 1);
6835		if (array_elem->nelems != 0)
6836			goto error;
6837
6838		moff = __btf_member_bit_offset(t, member) / 8;
6839		if (off < moff)
6840			goto error;
6841
6842		/* allow structure and integer */
 
 
6843		t = btf_type_skip_modifiers(btf, array_elem->type,
6844					    NULL);
6845
6846		if (btf_type_is_int(t))
6847			return WALK_SCALAR;
6848
6849		if (!btf_type_is_struct(t))
6850			goto error;
6851
6852		off = (off - moff) % t->size;
6853		goto again;
6854
6855error:
6856		bpf_log(log, "access beyond struct %s at off %u size %u\n",
6857			tname, off, size);
6858		return -EACCES;
6859	}
6860
6861	for_each_member(i, t, member) {
6862		/* offset of the field in bytes */
6863		moff = __btf_member_bit_offset(t, member) / 8;
6864		if (off + size <= moff)
6865			/* won't find anything, field is already too far */
6866			break;
6867
6868		if (__btf_member_bitfield_size(t, member)) {
6869			u32 end_bit = __btf_member_bit_offset(t, member) +
6870				__btf_member_bitfield_size(t, member);
6871
6872			/* off <= moff instead of off == moff because clang
6873			 * does not generate a BTF member for anonymous
6874			 * bitfield like the ":16" here:
6875			 * struct {
6876			 *	int :16;
6877			 *	int x:8;
6878			 * };
6879			 */
6880			if (off <= moff &&
6881			    BITS_ROUNDUP_BYTES(end_bit) <= off + size)
6882				return WALK_SCALAR;
6883
6884			/* off may be accessing a following member
6885			 *
6886			 * or
6887			 *
6888			 * Doing partial access at either end of this
6889			 * bitfield.  Continue on this case also to
6890			 * treat it as not accessing this bitfield
6891			 * and eventually error out as field not
6892			 * found to keep it simple.
6893			 * It could be relaxed if there was a legit
6894			 * partial access case later.
6895			 */
6896			continue;
6897		}
6898
6899		/* In case of "off" is pointing to holes of a struct */
6900		if (off < moff)
6901			break;
6902
6903		/* type of the field */
6904		mid = member->type;
6905		mtype = btf_type_by_id(btf, member->type);
6906		mname = __btf_name_by_offset(btf, member->name_off);
6907
6908		mtype = __btf_resolve_size(btf, mtype, &msize,
6909					   &elem_type, &elem_id, &total_nelems,
6910					   &mid);
6911		if (IS_ERR(mtype)) {
6912			bpf_log(log, "field %s doesn't have size\n", mname);
6913			return -EFAULT;
6914		}
6915
6916		mtrue_end = moff + msize;
6917		if (off >= mtrue_end)
6918			/* no overlap with member, keep iterating */
6919			continue;
6920
6921		if (btf_type_is_array(mtype)) {
6922			u32 elem_idx;
6923
6924			/* __btf_resolve_size() above helps to
6925			 * linearize a multi-dimensional array.
6926			 *
6927			 * The logic here is treating an array
6928			 * in a struct as the following way:
6929			 *
6930			 * struct outer {
6931			 *	struct inner array[2][2];
6932			 * };
6933			 *
6934			 * looks like:
6935			 *
6936			 * struct outer {
6937			 *	struct inner array_elem0;
6938			 *	struct inner array_elem1;
6939			 *	struct inner array_elem2;
6940			 *	struct inner array_elem3;
6941			 * };
6942			 *
6943			 * When accessing outer->array[1][0], it moves
6944			 * moff to "array_elem2", set mtype to
6945			 * "struct inner", and msize also becomes
6946			 * sizeof(struct inner).  Then most of the
6947			 * remaining logic will fall through without
6948			 * caring the current member is an array or
6949			 * not.
6950			 *
6951			 * Unlike mtype/msize/moff, mtrue_end does not
6952			 * change.  The naming difference ("_true") tells
6953			 * that it is not always corresponding to
6954			 * the current mtype/msize/moff.
6955			 * It is the true end of the current
6956			 * member (i.e. array in this case).  That
6957			 * will allow an int array to be accessed like
6958			 * a scratch space,
6959			 * i.e. allow access beyond the size of
6960			 *      the array's element as long as it is
6961			 *      within the mtrue_end boundary.
6962			 */
6963
6964			/* skip empty array */
6965			if (moff == mtrue_end)
6966				continue;
6967
6968			msize /= total_nelems;
6969			elem_idx = (off - moff) / msize;
6970			moff += elem_idx * msize;
6971			mtype = elem_type;
6972			mid = elem_id;
6973		}
6974
6975		/* the 'off' we're looking for is either equal to start
6976		 * of this field or inside of this struct
6977		 */
6978		if (btf_type_is_struct(mtype)) {
6979			/* our field must be inside that union or struct */
6980			t = mtype;
6981
6982			/* return if the offset matches the member offset */
6983			if (off == moff) {
6984				*next_btf_id = mid;
6985				return WALK_STRUCT;
6986			}
6987
6988			/* adjust offset we're looking for */
6989			off -= moff;
6990			goto again;
6991		}
6992
6993		if (btf_type_is_ptr(mtype)) {
6994			const struct btf_type *stype, *t;
6995			enum bpf_type_flag tmp_flag = 0;
6996			u32 id;
6997
6998			if (msize != size || off != moff) {
6999				bpf_log(log,
7000					"cannot access ptr member %s with moff %u in struct %s with off %u size %u\n",
7001					mname, moff, tname, off, size);
7002				return -EACCES;
7003			}
7004
7005			/* check type tag */
7006			t = btf_type_by_id(btf, mtype->type);
7007			if (btf_type_is_type_tag(t)) {
7008				tag_value = __btf_name_by_offset(btf, t->name_off);
7009				/* check __user tag */
7010				if (strcmp(tag_value, "user") == 0)
7011					tmp_flag = MEM_USER;
7012				/* check __percpu tag */
7013				if (strcmp(tag_value, "percpu") == 0)
7014					tmp_flag = MEM_PERCPU;
7015				/* check __rcu tag */
7016				if (strcmp(tag_value, "rcu") == 0)
7017					tmp_flag = MEM_RCU;
7018			}
7019
7020			stype = btf_type_skip_modifiers(btf, mtype->type, &id);
7021			if (btf_type_is_struct(stype)) {
7022				*next_btf_id = id;
7023				*flag |= tmp_flag;
7024				if (field_name)
7025					*field_name = mname;
7026				return WALK_PTR;
7027			}
7028		}
7029
7030		/* Allow more flexible access within an int as long as
7031		 * it is within mtrue_end.
7032		 * Since mtrue_end could be the end of an array,
7033		 * that also allows using an array of int as a scratch
7034		 * space. e.g. skb->cb[].
7035		 */
7036		if (off + size > mtrue_end && !(*flag & PTR_UNTRUSTED)) {
7037			bpf_log(log,
7038				"access beyond the end of member %s (mend:%u) in struct %s with off %u size %u\n",
7039				mname, mtrue_end, tname, off, size);
7040			return -EACCES;
7041		}
7042
7043		return WALK_SCALAR;
7044	}
7045	bpf_log(log, "struct %s doesn't have field at offset %d\n", tname, off);
7046	return -EINVAL;
7047}
7048
7049int btf_struct_access(struct bpf_verifier_log *log,
7050		      const struct bpf_reg_state *reg,
7051		      int off, int size, enum bpf_access_type atype __maybe_unused,
7052		      u32 *next_btf_id, enum bpf_type_flag *flag,
7053		      const char **field_name)
7054{
7055	const struct btf *btf = reg->btf;
7056	enum bpf_type_flag tmp_flag = 0;
7057	const struct btf_type *t;
7058	u32 id = reg->btf_id;
7059	int err;
7060
7061	while (type_is_alloc(reg->type)) {
7062		struct btf_struct_meta *meta;
7063		struct btf_record *rec;
7064		int i;
7065
7066		meta = btf_find_struct_meta(btf, id);
7067		if (!meta)
7068			break;
7069		rec = meta->record;
7070		for (i = 0; i < rec->cnt; i++) {
7071			struct btf_field *field = &rec->fields[i];
7072			u32 offset = field->offset;
7073			if (off < offset + field->size && offset < off + size) {
7074				bpf_log(log,
7075					"direct access to %s is disallowed\n",
7076					btf_field_type_name(field->type));
7077				return -EACCES;
7078			}
7079		}
7080		break;
7081	}
7082
7083	t = btf_type_by_id(btf, id);
7084	do {
7085		err = btf_struct_walk(log, btf, t, off, size, &id, &tmp_flag, field_name);
7086
7087		switch (err) {
7088		case WALK_PTR:
7089			/* For local types, the destination register cannot
7090			 * become a pointer again.
7091			 */
7092			if (type_is_alloc(reg->type))
7093				return SCALAR_VALUE;
7094			/* If we found the pointer or scalar on t+off,
7095			 * we're done.
7096			 */
7097			*next_btf_id = id;
7098			*flag = tmp_flag;
7099			return PTR_TO_BTF_ID;
7100		case WALK_SCALAR:
7101			return SCALAR_VALUE;
7102		case WALK_STRUCT:
7103			/* We found nested struct, so continue the search
7104			 * by diving in it. At this point the offset is
7105			 * aligned with the new type, so set it to 0.
7106			 */
7107			t = btf_type_by_id(btf, id);
7108			off = 0;
7109			break;
7110		default:
7111			/* It's either error or unknown return value..
7112			 * scream and leave.
7113			 */
7114			if (WARN_ONCE(err > 0, "unknown btf_struct_walk return value"))
7115				return -EINVAL;
7116			return err;
7117		}
7118	} while (t);
7119
7120	return -EINVAL;
7121}
7122
7123/* Check that two BTF types, each specified as an BTF object + id, are exactly
7124 * the same. Trivial ID check is not enough due to module BTFs, because we can
7125 * end up with two different module BTFs, but IDs point to the common type in
7126 * vmlinux BTF.
7127 */
7128bool btf_types_are_same(const struct btf *btf1, u32 id1,
7129			const struct btf *btf2, u32 id2)
7130{
7131	if (id1 != id2)
7132		return false;
7133	if (btf1 == btf2)
7134		return true;
7135	return btf_type_by_id(btf1, id1) == btf_type_by_id(btf2, id2);
7136}
7137
7138bool btf_struct_ids_match(struct bpf_verifier_log *log,
7139			  const struct btf *btf, u32 id, int off,
7140			  const struct btf *need_btf, u32 need_type_id,
7141			  bool strict)
7142{
7143	const struct btf_type *type;
7144	enum bpf_type_flag flag = 0;
7145	int err;
7146
7147	/* Are we already done? */
7148	if (off == 0 && btf_types_are_same(btf, id, need_btf, need_type_id))
7149		return true;
7150	/* In case of strict type match, we do not walk struct, the top level
7151	 * type match must succeed. When strict is true, off should have already
7152	 * been 0.
7153	 */
7154	if (strict)
7155		return false;
7156again:
7157	type = btf_type_by_id(btf, id);
7158	if (!type)
7159		return false;
7160	err = btf_struct_walk(log, btf, type, off, 1, &id, &flag, NULL);
7161	if (err != WALK_STRUCT)
7162		return false;
7163
7164	/* We found nested struct object. If it matches
7165	 * the requested ID, we're done. Otherwise let's
7166	 * continue the search with offset 0 in the new
7167	 * type.
7168	 */
7169	if (!btf_types_are_same(btf, id, need_btf, need_type_id)) {
7170		off = 0;
7171		goto again;
7172	}
7173
7174	return true;
7175}
7176
7177static int __get_type_size(struct btf *btf, u32 btf_id,
7178			   const struct btf_type **ret_type)
7179{
7180	const struct btf_type *t;
7181
7182	*ret_type = btf_type_by_id(btf, 0);
7183	if (!btf_id)
7184		/* void */
7185		return 0;
7186	t = btf_type_by_id(btf, btf_id);
7187	while (t && btf_type_is_modifier(t))
7188		t = btf_type_by_id(btf, t->type);
7189	if (!t)
7190		return -EINVAL;
7191	*ret_type = t;
7192	if (btf_type_is_ptr(t))
7193		/* kernel size of pointer. Not BPF's size of pointer*/
7194		return sizeof(void *);
7195	if (btf_type_is_int(t) || btf_is_any_enum(t) || __btf_type_is_struct(t))
7196		return t->size;
7197	return -EINVAL;
7198}
7199
7200static u8 __get_type_fmodel_flags(const struct btf_type *t)
7201{
7202	u8 flags = 0;
7203
7204	if (__btf_type_is_struct(t))
7205		flags |= BTF_FMODEL_STRUCT_ARG;
7206	if (btf_type_is_signed_int(t))
7207		flags |= BTF_FMODEL_SIGNED_ARG;
7208
7209	return flags;
7210}
7211
7212int btf_distill_func_proto(struct bpf_verifier_log *log,
7213			   struct btf *btf,
7214			   const struct btf_type *func,
7215			   const char *tname,
7216			   struct btf_func_model *m)
7217{
7218	const struct btf_param *args;
7219	const struct btf_type *t;
7220	u32 i, nargs;
7221	int ret;
7222
7223	if (!func) {
7224		/* BTF function prototype doesn't match the verifier types.
7225		 * Fall back to MAX_BPF_FUNC_REG_ARGS u64 args.
7226		 */
7227		for (i = 0; i < MAX_BPF_FUNC_REG_ARGS; i++) {
7228			m->arg_size[i] = 8;
7229			m->arg_flags[i] = 0;
7230		}
7231		m->ret_size = 8;
7232		m->ret_flags = 0;
7233		m->nr_args = MAX_BPF_FUNC_REG_ARGS;
7234		return 0;
7235	}
7236	args = (const struct btf_param *)(func + 1);
7237	nargs = btf_type_vlen(func);
7238	if (nargs > MAX_BPF_FUNC_ARGS) {
7239		bpf_log(log,
7240			"The function %s has %d arguments. Too many.\n",
7241			tname, nargs);
7242		return -EINVAL;
7243	}
7244	ret = __get_type_size(btf, func->type, &t);
7245	if (ret < 0 || __btf_type_is_struct(t)) {
7246		bpf_log(log,
7247			"The function %s return type %s is unsupported.\n",
7248			tname, btf_type_str(t));
7249		return -EINVAL;
7250	}
7251	m->ret_size = ret;
7252	m->ret_flags = __get_type_fmodel_flags(t);
7253
7254	for (i = 0; i < nargs; i++) {
7255		if (i == nargs - 1 && args[i].type == 0) {
7256			bpf_log(log,
7257				"The function %s with variable args is unsupported.\n",
7258				tname);
7259			return -EINVAL;
7260		}
7261		ret = __get_type_size(btf, args[i].type, &t);
7262
7263		/* No support of struct argument size greater than 16 bytes */
7264		if (ret < 0 || ret > 16) {
7265			bpf_log(log,
7266				"The function %s arg%d type %s is unsupported.\n",
7267				tname, i, btf_type_str(t));
7268			return -EINVAL;
7269		}
7270		if (ret == 0) {
7271			bpf_log(log,
7272				"The function %s has malformed void argument.\n",
7273				tname);
7274			return -EINVAL;
7275		}
7276		m->arg_size[i] = ret;
7277		m->arg_flags[i] = __get_type_fmodel_flags(t);
7278	}
7279	m->nr_args = nargs;
7280	return 0;
7281}
7282
7283/* Compare BTFs of two functions assuming only scalars and pointers to context.
7284 * t1 points to BTF_KIND_FUNC in btf1
7285 * t2 points to BTF_KIND_FUNC in btf2
7286 * Returns:
7287 * EINVAL - function prototype mismatch
7288 * EFAULT - verifier bug
7289 * 0 - 99% match. The last 1% is validated by the verifier.
7290 */
7291static int btf_check_func_type_match(struct bpf_verifier_log *log,
7292				     struct btf *btf1, const struct btf_type *t1,
7293				     struct btf *btf2, const struct btf_type *t2)
7294{
7295	const struct btf_param *args1, *args2;
7296	const char *fn1, *fn2, *s1, *s2;
7297	u32 nargs1, nargs2, i;
7298
7299	fn1 = btf_name_by_offset(btf1, t1->name_off);
7300	fn2 = btf_name_by_offset(btf2, t2->name_off);
7301
7302	if (btf_func_linkage(t1) != BTF_FUNC_GLOBAL) {
7303		bpf_log(log, "%s() is not a global function\n", fn1);
7304		return -EINVAL;
7305	}
7306	if (btf_func_linkage(t2) != BTF_FUNC_GLOBAL) {
7307		bpf_log(log, "%s() is not a global function\n", fn2);
7308		return -EINVAL;
7309	}
7310
7311	t1 = btf_type_by_id(btf1, t1->type);
7312	if (!t1 || !btf_type_is_func_proto(t1))
7313		return -EFAULT;
7314	t2 = btf_type_by_id(btf2, t2->type);
7315	if (!t2 || !btf_type_is_func_proto(t2))
7316		return -EFAULT;
7317
7318	args1 = (const struct btf_param *)(t1 + 1);
7319	nargs1 = btf_type_vlen(t1);
7320	args2 = (const struct btf_param *)(t2 + 1);
7321	nargs2 = btf_type_vlen(t2);
7322
7323	if (nargs1 != nargs2) {
7324		bpf_log(log, "%s() has %d args while %s() has %d args\n",
7325			fn1, nargs1, fn2, nargs2);
7326		return -EINVAL;
7327	}
7328
7329	t1 = btf_type_skip_modifiers(btf1, t1->type, NULL);
7330	t2 = btf_type_skip_modifiers(btf2, t2->type, NULL);
7331	if (t1->info != t2->info) {
7332		bpf_log(log,
7333			"Return type %s of %s() doesn't match type %s of %s()\n",
7334			btf_type_str(t1), fn1,
7335			btf_type_str(t2), fn2);
7336		return -EINVAL;
7337	}
7338
7339	for (i = 0; i < nargs1; i++) {
7340		t1 = btf_type_skip_modifiers(btf1, args1[i].type, NULL);
7341		t2 = btf_type_skip_modifiers(btf2, args2[i].type, NULL);
7342
7343		if (t1->info != t2->info) {
7344			bpf_log(log, "arg%d in %s() is %s while %s() has %s\n",
7345				i, fn1, btf_type_str(t1),
7346				fn2, btf_type_str(t2));
7347			return -EINVAL;
7348		}
7349		if (btf_type_has_size(t1) && t1->size != t2->size) {
7350			bpf_log(log,
7351				"arg%d in %s() has size %d while %s() has %d\n",
7352				i, fn1, t1->size,
7353				fn2, t2->size);
7354			return -EINVAL;
7355		}
7356
7357		/* global functions are validated with scalars and pointers
7358		 * to context only. And only global functions can be replaced.
7359		 * Hence type check only those types.
7360		 */
7361		if (btf_type_is_int(t1) || btf_is_any_enum(t1))
7362			continue;
7363		if (!btf_type_is_ptr(t1)) {
7364			bpf_log(log,
7365				"arg%d in %s() has unrecognized type\n",
7366				i, fn1);
7367			return -EINVAL;
7368		}
7369		t1 = btf_type_skip_modifiers(btf1, t1->type, NULL);
7370		t2 = btf_type_skip_modifiers(btf2, t2->type, NULL);
7371		if (!btf_type_is_struct(t1)) {
7372			bpf_log(log,
7373				"arg%d in %s() is not a pointer to context\n",
7374				i, fn1);
7375			return -EINVAL;
7376		}
7377		if (!btf_type_is_struct(t2)) {
7378			bpf_log(log,
7379				"arg%d in %s() is not a pointer to context\n",
7380				i, fn2);
7381			return -EINVAL;
7382		}
7383		/* This is an optional check to make program writing easier.
7384		 * Compare names of structs and report an error to the user.
7385		 * btf_prepare_func_args() already checked that t2 struct
7386		 * is a context type. btf_prepare_func_args() will check
7387		 * later that t1 struct is a context type as well.
7388		 */
7389		s1 = btf_name_by_offset(btf1, t1->name_off);
7390		s2 = btf_name_by_offset(btf2, t2->name_off);
7391		if (strcmp(s1, s2)) {
7392			bpf_log(log,
7393				"arg%d %s(struct %s *) doesn't match %s(struct %s *)\n",
7394				i, fn1, s1, fn2, s2);
7395			return -EINVAL;
7396		}
7397	}
7398	return 0;
7399}
7400
7401/* Compare BTFs of given program with BTF of target program */
7402int btf_check_type_match(struct bpf_verifier_log *log, const struct bpf_prog *prog,
7403			 struct btf *btf2, const struct btf_type *t2)
7404{
7405	struct btf *btf1 = prog->aux->btf;
7406	const struct btf_type *t1;
7407	u32 btf_id = 0;
7408
7409	if (!prog->aux->func_info) {
7410		bpf_log(log, "Program extension requires BTF\n");
7411		return -EINVAL;
7412	}
7413
7414	btf_id = prog->aux->func_info[0].type_id;
7415	if (!btf_id)
7416		return -EFAULT;
7417
7418	t1 = btf_type_by_id(btf1, btf_id);
7419	if (!t1 || !btf_type_is_func(t1))
7420		return -EFAULT;
7421
7422	return btf_check_func_type_match(log, btf1, t1, btf2, t2);
7423}
7424
7425static bool btf_is_dynptr_ptr(const struct btf *btf, const struct btf_type *t)
 
 
 
 
7426{
7427	const char *name;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
7428
7429	t = btf_type_by_id(btf, t->type); /* skip PTR */
 
 
 
 
 
 
 
 
 
 
 
 
7430
7431	while (btf_type_is_modifier(t))
7432		t = btf_type_by_id(btf, t->type);
 
 
 
 
 
 
7433
7434	/* allow either struct or struct forward declaration */
7435	if (btf_type_is_struct(t) ||
7436	    (btf_type_is_fwd(t) && btf_type_kflag(t) == 0)) {
7437		name = btf_str_by_offset(btf, t->name_off);
7438		return name && strcmp(name, "bpf_dynptr") == 0;
 
 
7439	}
7440
7441	return false;
7442}
7443
7444struct bpf_cand_cache {
7445	const char *name;
7446	u32 name_len;
7447	u16 kind;
7448	u16 cnt;
7449	struct {
7450		const struct btf *btf;
7451		u32 id;
7452	} cands[];
7453};
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
7454
7455static DEFINE_MUTEX(cand_cache_mutex);
 
7456
7457static struct bpf_cand_cache *
7458bpf_core_find_cands(struct bpf_core_ctx *ctx, u32 local_type_id);
 
 
 
 
 
 
7459
7460static int btf_get_ptr_to_btf_id(struct bpf_verifier_log *log, int arg_idx,
7461				 const struct btf *btf, const struct btf_type *t)
 
 
 
 
 
 
 
 
 
 
 
 
7462{
7463	struct bpf_cand_cache *cc;
7464	struct bpf_core_ctx ctx = {
7465		.btf = btf,
7466		.log = log,
7467	};
7468	u32 kern_type_id, type_id;
7469	int err = 0;
 
 
 
 
 
7470
7471	/* skip PTR and modifiers */
7472	type_id = t->type;
7473	t = btf_type_by_id(btf, t->type);
7474	while (btf_type_is_modifier(t)) {
7475		type_id = t->type;
7476		t = btf_type_by_id(btf, t->type);
7477	}
7478
7479	mutex_lock(&cand_cache_mutex);
7480	cc = bpf_core_find_cands(&ctx, type_id);
7481	if (IS_ERR(cc)) {
7482		err = PTR_ERR(cc);
7483		bpf_log(log, "arg#%d reference type('%s %s') candidate matching error: %d\n",
7484			arg_idx, btf_type_str(t), __btf_name_by_offset(btf, t->name_off),
7485			err);
7486		goto cand_cache_unlock;
7487	}
7488	if (cc->cnt != 1) {
7489		bpf_log(log, "arg#%d reference type('%s %s') %s\n",
7490			arg_idx, btf_type_str(t), __btf_name_by_offset(btf, t->name_off),
7491			cc->cnt == 0 ? "has no matches" : "is ambiguous");
7492		err = cc->cnt == 0 ? -ENOENT : -ESRCH;
7493		goto cand_cache_unlock;
7494	}
7495	if (btf_is_module(cc->cands[0].btf)) {
7496		bpf_log(log, "arg#%d reference type('%s %s') points to kernel module type (unsupported)\n",
7497			arg_idx, btf_type_str(t), __btf_name_by_offset(btf, t->name_off));
7498		err = -EOPNOTSUPP;
7499		goto cand_cache_unlock;
7500	}
7501	kern_type_id = cc->cands[0].id;
7502
7503cand_cache_unlock:
7504	mutex_unlock(&cand_cache_mutex);
 
 
7505	if (err)
7506		return err;
7507
7508	return kern_type_id;
7509}
7510
7511enum btf_arg_tag {
7512	ARG_TAG_CTX	 = BIT_ULL(0),
7513	ARG_TAG_NONNULL  = BIT_ULL(1),
7514	ARG_TAG_TRUSTED  = BIT_ULL(2),
7515	ARG_TAG_NULLABLE = BIT_ULL(3),
7516	ARG_TAG_ARENA	 = BIT_ULL(4),
7517};
7518
7519/* Process BTF of a function to produce high-level expectation of function
7520 * arguments (like ARG_PTR_TO_CTX, or ARG_PTR_TO_MEM, etc). This information
7521 * is cached in subprog info for reuse.
7522 * Returns:
7523 * EFAULT - there is a verifier bug. Abort verification.
7524 * EINVAL - cannot convert BTF.
7525 * 0 - Successfully processed BTF and constructed argument expectations.
 
7526 */
7527int btf_prepare_func_args(struct bpf_verifier_env *env, int subprog)
 
7528{
7529	bool is_global = subprog_aux(env, subprog)->linkage == BTF_FUNC_GLOBAL;
7530	struct bpf_subprog_info *sub = subprog_info(env, subprog);
7531	struct bpf_verifier_log *log = &env->log;
7532	struct bpf_prog *prog = env->prog;
7533	enum bpf_prog_type prog_type = prog->type;
7534	struct btf *btf = prog->aux->btf;
7535	const struct btf_param *args;
7536	const struct btf_type *t, *ref_t, *fn_t;
7537	u32 i, nargs, btf_id;
7538	const char *tname;
7539
7540	if (sub->args_cached)
7541		return 0;
7542
7543	if (!prog->aux->func_info) {
7544		bpf_log(log, "Verifier bug\n");
7545		return -EFAULT;
7546	}
7547
7548	btf_id = prog->aux->func_info[subprog].type_id;
7549	if (!btf_id) {
7550		if (!is_global) /* not fatal for static funcs */
7551			return -EINVAL;
7552		bpf_log(log, "Global functions need valid BTF\n");
7553		return -EFAULT;
7554	}
7555
7556	fn_t = btf_type_by_id(btf, btf_id);
7557	if (!fn_t || !btf_type_is_func(fn_t)) {
7558		/* These checks were already done by the verifier while loading
7559		 * struct bpf_func_info
7560		 */
7561		bpf_log(log, "BTF of func#%d doesn't point to KIND_FUNC\n",
7562			subprog);
7563		return -EFAULT;
7564	}
7565	tname = btf_name_by_offset(btf, fn_t->name_off);
 
 
 
 
7566
7567	if (prog->aux->func_info_aux[subprog].unreliable) {
7568		bpf_log(log, "Verifier bug in function %s()\n", tname);
7569		return -EFAULT;
7570	}
7571	if (prog_type == BPF_PROG_TYPE_EXT)
7572		prog_type = prog->aux->dst_prog->type;
7573
7574	t = btf_type_by_id(btf, fn_t->type);
7575	if (!t || !btf_type_is_func_proto(t)) {
7576		bpf_log(log, "Invalid type of function %s()\n", tname);
7577		return -EFAULT;
7578	}
7579	args = (const struct btf_param *)(t + 1);
7580	nargs = btf_type_vlen(t);
7581	if (nargs > MAX_BPF_FUNC_REG_ARGS) {
7582		if (!is_global)
7583			return -EINVAL;
7584		bpf_log(log, "Global function %s() with %d > %d args. Buggy compiler.\n",
7585			tname, nargs, MAX_BPF_FUNC_REG_ARGS);
7586		return -EINVAL;
7587	}
7588	/* check that function returns int, exception cb also requires this */
7589	t = btf_type_by_id(btf, t->type);
7590	while (btf_type_is_modifier(t))
7591		t = btf_type_by_id(btf, t->type);
7592	if (!btf_type_is_int(t) && !btf_is_any_enum(t)) {
7593		if (!is_global)
7594			return -EINVAL;
7595		bpf_log(log,
7596			"Global function %s() doesn't return scalar. Only those are supported.\n",
7597			tname);
7598		return -EINVAL;
7599	}
7600	/* Convert BTF function arguments into verifier types.
7601	 * Only PTR_TO_CTX and SCALAR are supported atm.
7602	 */
7603	for (i = 0; i < nargs; i++) {
7604		u32 tags = 0;
7605		int id = 0;
7606
7607		/* 'arg:<tag>' decl_tag takes precedence over derivation of
7608		 * register type from BTF type itself
7609		 */
7610		while ((id = btf_find_next_decl_tag(btf, fn_t, i, "arg:", id)) > 0) {
7611			const struct btf_type *tag_t = btf_type_by_id(btf, id);
7612			const char *tag = __btf_name_by_offset(btf, tag_t->name_off) + 4;
7613
7614			/* disallow arg tags in static subprogs */
7615			if (!is_global) {
7616				bpf_log(log, "arg#%d type tag is not supported in static functions\n", i);
7617				return -EOPNOTSUPP;
7618			}
7619
7620			if (strcmp(tag, "ctx") == 0) {
7621				tags |= ARG_TAG_CTX;
7622			} else if (strcmp(tag, "trusted") == 0) {
7623				tags |= ARG_TAG_TRUSTED;
7624			} else if (strcmp(tag, "nonnull") == 0) {
7625				tags |= ARG_TAG_NONNULL;
7626			} else if (strcmp(tag, "nullable") == 0) {
7627				tags |= ARG_TAG_NULLABLE;
7628			} else if (strcmp(tag, "arena") == 0) {
7629				tags |= ARG_TAG_ARENA;
7630			} else {
7631				bpf_log(log, "arg#%d has unsupported set of tags\n", i);
7632				return -EOPNOTSUPP;
7633			}
7634		}
7635		if (id != -ENOENT) {
7636			bpf_log(log, "arg#%d type tag fetching failure: %d\n", i, id);
7637			return id;
7638		}
7639
7640		t = btf_type_by_id(btf, args[i].type);
7641		while (btf_type_is_modifier(t))
7642			t = btf_type_by_id(btf, t->type);
7643		if (!btf_type_is_ptr(t))
7644			goto skip_pointer;
7645
7646		if ((tags & ARG_TAG_CTX) || btf_is_prog_ctx_type(log, btf, t, prog_type, i)) {
7647			if (tags & ~ARG_TAG_CTX) {
7648				bpf_log(log, "arg#%d has invalid combination of tags\n", i);
7649				return -EINVAL;
7650			}
7651			if ((tags & ARG_TAG_CTX) &&
7652			    btf_validate_prog_ctx_type(log, btf, t, i, prog_type,
7653						       prog->expected_attach_type))
7654				return -EINVAL;
7655			sub->args[i].arg_type = ARG_PTR_TO_CTX;
7656			continue;
7657		}
7658		if (btf_is_dynptr_ptr(btf, t)) {
7659			if (tags) {
7660				bpf_log(log, "arg#%d has invalid combination of tags\n", i);
7661				return -EINVAL;
7662			}
7663			sub->args[i].arg_type = ARG_PTR_TO_DYNPTR | MEM_RDONLY;
7664			continue;
7665		}
7666		if (tags & ARG_TAG_TRUSTED) {
7667			int kern_type_id;
7668
7669			if (tags & ARG_TAG_NONNULL) {
7670				bpf_log(log, "arg#%d has invalid combination of tags\n", i);
7671				return -EINVAL;
7672			}
7673
7674			kern_type_id = btf_get_ptr_to_btf_id(log, i, btf, t);
7675			if (kern_type_id < 0)
7676				return kern_type_id;
7677
7678			sub->args[i].arg_type = ARG_PTR_TO_BTF_ID | PTR_TRUSTED;
7679			if (tags & ARG_TAG_NULLABLE)
7680				sub->args[i].arg_type |= PTR_MAYBE_NULL;
7681			sub->args[i].btf_id = kern_type_id;
7682			continue;
7683		}
7684		if (tags & ARG_TAG_ARENA) {
7685			if (tags & ~ARG_TAG_ARENA) {
7686				bpf_log(log, "arg#%d arena cannot be combined with any other tags\n", i);
7687				return -EINVAL;
7688			}
7689			sub->args[i].arg_type = ARG_PTR_TO_ARENA;
7690			continue;
7691		}
7692		if (is_global) { /* generic user data pointer */
7693			u32 mem_size;
7694
7695			if (tags & ARG_TAG_NULLABLE) {
7696				bpf_log(log, "arg#%d has invalid combination of tags\n", i);
7697				return -EINVAL;
7698			}
7699
7700			t = btf_type_skip_modifiers(btf, t->type, NULL);
7701			ref_t = btf_resolve_size(btf, t, &mem_size);
7702			if (IS_ERR(ref_t)) {
7703				bpf_log(log, "arg#%d reference type('%s %s') size cannot be determined: %ld\n",
7704					i, btf_type_str(t), btf_name_by_offset(btf, t->name_off),
 
7705					PTR_ERR(ref_t));
7706				return -EINVAL;
7707			}
7708
7709			sub->args[i].arg_type = ARG_PTR_TO_MEM | PTR_MAYBE_NULL;
7710			if (tags & ARG_TAG_NONNULL)
7711				sub->args[i].arg_type &= ~PTR_MAYBE_NULL;
7712			sub->args[i].mem_size = mem_size;
7713			continue;
7714		}
7715
7716skip_pointer:
7717		if (tags) {
7718			bpf_log(log, "arg#%d has pointer tag, but is not a pointer type\n", i);
7719			return -EINVAL;
7720		}
7721		if (btf_type_is_int(t) || btf_is_any_enum(t)) {
7722			sub->args[i].arg_type = ARG_ANYTHING;
7723			continue;
7724		}
7725		if (!is_global)
7726			return -EINVAL;
7727		bpf_log(log, "Arg#%d type %s in %s() is not supported yet.\n",
7728			i, btf_type_str(t), tname);
7729		return -EINVAL;
7730	}
7731
7732	sub->arg_cnt = nargs;
7733	sub->args_cached = true;
7734
7735	return 0;
7736}
7737
7738static void btf_type_show(const struct btf *btf, u32 type_id, void *obj,
7739			  struct btf_show *show)
7740{
7741	const struct btf_type *t = btf_type_by_id(btf, type_id);
7742
7743	show->btf = btf;
7744	memset(&show->state, 0, sizeof(show->state));
7745	memset(&show->obj, 0, sizeof(show->obj));
7746
7747	btf_type_ops(t)->show(btf, t, type_id, obj, 0, show);
7748}
7749
7750__printf(2, 0) static void btf_seq_show(struct btf_show *show, const char *fmt,
7751					va_list args)
7752{
7753	seq_vprintf((struct seq_file *)show->target, fmt, args);
7754}
7755
7756int btf_type_seq_show_flags(const struct btf *btf, u32 type_id,
7757			    void *obj, struct seq_file *m, u64 flags)
7758{
7759	struct btf_show sseq;
7760
7761	sseq.target = m;
7762	sseq.showfn = btf_seq_show;
7763	sseq.flags = flags;
7764
7765	btf_type_show(btf, type_id, obj, &sseq);
7766
7767	return sseq.state.status;
7768}
7769
7770void btf_type_seq_show(const struct btf *btf, u32 type_id, void *obj,
7771		       struct seq_file *m)
7772{
7773	(void) btf_type_seq_show_flags(btf, type_id, obj, m,
7774				       BTF_SHOW_NONAME | BTF_SHOW_COMPACT |
7775				       BTF_SHOW_ZERO | BTF_SHOW_UNSAFE);
7776}
7777
7778struct btf_show_snprintf {
7779	struct btf_show show;
7780	int len_left;		/* space left in string */
7781	int len;		/* length we would have written */
7782};
7783
7784__printf(2, 0) static void btf_snprintf_show(struct btf_show *show, const char *fmt,
7785					     va_list args)
7786{
7787	struct btf_show_snprintf *ssnprintf = (struct btf_show_snprintf *)show;
7788	int len;
7789
7790	len = vsnprintf(show->target, ssnprintf->len_left, fmt, args);
7791
7792	if (len < 0) {
7793		ssnprintf->len_left = 0;
7794		ssnprintf->len = len;
7795	} else if (len >= ssnprintf->len_left) {
7796		/* no space, drive on to get length we would have written */
7797		ssnprintf->len_left = 0;
7798		ssnprintf->len += len;
7799	} else {
7800		ssnprintf->len_left -= len;
7801		ssnprintf->len += len;
7802		show->target += len;
7803	}
7804}
7805
7806int btf_type_snprintf_show(const struct btf *btf, u32 type_id, void *obj,
7807			   char *buf, int len, u64 flags)
7808{
7809	struct btf_show_snprintf ssnprintf;
7810
7811	ssnprintf.show.target = buf;
7812	ssnprintf.show.flags = flags;
7813	ssnprintf.show.showfn = btf_snprintf_show;
7814	ssnprintf.len_left = len;
7815	ssnprintf.len = 0;
7816
7817	btf_type_show(btf, type_id, obj, (struct btf_show *)&ssnprintf);
7818
7819	/* If we encountered an error, return it. */
7820	if (ssnprintf.show.state.status)
7821		return ssnprintf.show.state.status;
7822
7823	/* Otherwise return length we would have written */
7824	return ssnprintf.len;
7825}
7826
7827#ifdef CONFIG_PROC_FS
7828static void bpf_btf_show_fdinfo(struct seq_file *m, struct file *filp)
7829{
7830	const struct btf *btf = filp->private_data;
7831
7832	seq_printf(m, "btf_id:\t%u\n", btf->id);
7833}
7834#endif
7835
7836static int btf_release(struct inode *inode, struct file *filp)
7837{
7838	btf_put(filp->private_data);
7839	return 0;
7840}
7841
7842const struct file_operations btf_fops = {
7843#ifdef CONFIG_PROC_FS
7844	.show_fdinfo	= bpf_btf_show_fdinfo,
7845#endif
7846	.release	= btf_release,
7847};
7848
7849static int __btf_new_fd(struct btf *btf)
7850{
7851	return anon_inode_getfd("btf", &btf_fops, btf, O_RDONLY | O_CLOEXEC);
7852}
7853
7854int btf_new_fd(const union bpf_attr *attr, bpfptr_t uattr, u32 uattr_size)
7855{
7856	struct btf *btf;
7857	int ret;
7858
7859	btf = btf_parse(attr, uattr, uattr_size);
 
 
 
7860	if (IS_ERR(btf))
7861		return PTR_ERR(btf);
7862
7863	ret = btf_alloc_id(btf);
7864	if (ret) {
7865		btf_free(btf);
7866		return ret;
7867	}
7868
7869	/*
7870	 * The BTF ID is published to the userspace.
7871	 * All BTF free must go through call_rcu() from
7872	 * now on (i.e. free by calling btf_put()).
7873	 */
7874
7875	ret = __btf_new_fd(btf);
7876	if (ret < 0)
7877		btf_put(btf);
7878
7879	return ret;
7880}
7881
7882struct btf *btf_get_by_fd(int fd)
7883{
7884	struct btf *btf;
7885	CLASS(fd, f)(fd);
 
 
7886
7887	if (fd_empty(f))
7888		return ERR_PTR(-EBADF);
7889
7890	if (fd_file(f)->f_op != &btf_fops)
 
7891		return ERR_PTR(-EINVAL);
 
7892
7893	btf = fd_file(f)->private_data;
7894	refcount_inc(&btf->refcnt);
 
7895
7896	return btf;
7897}
7898
7899int btf_get_info_by_fd(const struct btf *btf,
7900		       const union bpf_attr *attr,
7901		       union bpf_attr __user *uattr)
7902{
7903	struct bpf_btf_info __user *uinfo;
7904	struct bpf_btf_info info;
7905	u32 info_copy, btf_copy;
7906	void __user *ubtf;
7907	char __user *uname;
7908	u32 uinfo_len, uname_len, name_len;
7909	int ret = 0;
7910
7911	uinfo = u64_to_user_ptr(attr->info.info);
7912	uinfo_len = attr->info.info_len;
7913
7914	info_copy = min_t(u32, uinfo_len, sizeof(info));
7915	memset(&info, 0, sizeof(info));
7916	if (copy_from_user(&info, uinfo, info_copy))
7917		return -EFAULT;
7918
7919	info.id = btf->id;
7920	ubtf = u64_to_user_ptr(info.btf);
7921	btf_copy = min_t(u32, btf->data_size, info.btf_size);
7922	if (copy_to_user(ubtf, btf->data, btf_copy))
7923		return -EFAULT;
7924	info.btf_size = btf->data_size;
7925
7926	info.kernel_btf = btf->kernel_btf;
7927
7928	uname = u64_to_user_ptr(info.name);
7929	uname_len = info.name_len;
7930	if (!uname ^ !uname_len)
7931		return -EINVAL;
7932
7933	name_len = strlen(btf->name);
7934	info.name_len = name_len;
7935
7936	if (uname) {
7937		if (uname_len >= name_len + 1) {
7938			if (copy_to_user(uname, btf->name, name_len + 1))
7939				return -EFAULT;
7940		} else {
7941			char zero = '\0';
7942
7943			if (copy_to_user(uname, btf->name, uname_len - 1))
7944				return -EFAULT;
7945			if (put_user(zero, uname + uname_len - 1))
7946				return -EFAULT;
7947			/* let user-space know about too short buffer */
7948			ret = -ENOSPC;
7949		}
7950	}
7951
7952	if (copy_to_user(uinfo, &info, info_copy) ||
7953	    put_user(info_copy, &uattr->info.info_len))
7954		return -EFAULT;
7955
7956	return ret;
7957}
7958
7959int btf_get_fd_by_id(u32 id)
7960{
7961	struct btf *btf;
7962	int fd;
7963
7964	rcu_read_lock();
7965	btf = idr_find(&btf_idr, id);
7966	if (!btf || !refcount_inc_not_zero(&btf->refcnt))
7967		btf = ERR_PTR(-ENOENT);
7968	rcu_read_unlock();
7969
7970	if (IS_ERR(btf))
7971		return PTR_ERR(btf);
7972
7973	fd = __btf_new_fd(btf);
7974	if (fd < 0)
7975		btf_put(btf);
7976
7977	return fd;
7978}
7979
7980u32 btf_obj_id(const struct btf *btf)
7981{
7982	return btf->id;
7983}
7984
7985bool btf_is_kernel(const struct btf *btf)
7986{
7987	return btf->kernel_btf;
7988}
7989
7990bool btf_is_module(const struct btf *btf)
7991{
7992	return btf->kernel_btf && strcmp(btf->name, "vmlinux") != 0;
7993}
7994
7995enum {
7996	BTF_MODULE_F_LIVE = (1 << 0),
7997};
7998
7999#ifdef CONFIG_DEBUG_INFO_BTF_MODULES
8000struct btf_module {
8001	struct list_head list;
8002	struct module *module;
8003	struct btf *btf;
8004	struct bin_attribute *sysfs_attr;
8005	int flags;
8006};
8007
8008static LIST_HEAD(btf_modules);
8009static DEFINE_MUTEX(btf_module_mutex);
8010
8011static ssize_t
8012btf_module_read(struct file *file, struct kobject *kobj,
8013		struct bin_attribute *bin_attr,
8014		char *buf, loff_t off, size_t len)
8015{
8016	const struct btf *btf = bin_attr->private;
8017
8018	memcpy(buf, btf->data + off, len);
8019	return len;
8020}
8021
8022static void purge_cand_cache(struct btf *btf);
8023
8024static int btf_module_notify(struct notifier_block *nb, unsigned long op,
8025			     void *module)
8026{
8027	struct btf_module *btf_mod, *tmp;
8028	struct module *mod = module;
8029	struct btf *btf;
8030	int err = 0;
8031
8032	if (mod->btf_data_size == 0 ||
8033	    (op != MODULE_STATE_COMING && op != MODULE_STATE_LIVE &&
8034	     op != MODULE_STATE_GOING))
8035		goto out;
8036
8037	switch (op) {
8038	case MODULE_STATE_COMING:
8039		btf_mod = kzalloc(sizeof(*btf_mod), GFP_KERNEL);
8040		if (!btf_mod) {
8041			err = -ENOMEM;
8042			goto out;
8043		}
8044		btf = btf_parse_module(mod->name, mod->btf_data, mod->btf_data_size,
8045				       mod->btf_base_data, mod->btf_base_data_size);
8046		if (IS_ERR(btf)) {
 
 
8047			kfree(btf_mod);
8048			if (!IS_ENABLED(CONFIG_MODULE_ALLOW_BTF_MISMATCH)) {
8049				pr_warn("failed to validate module [%s] BTF: %ld\n",
8050					mod->name, PTR_ERR(btf));
8051				err = PTR_ERR(btf);
8052			} else {
8053				pr_warn_once("Kernel module BTF mismatch detected, BTF debug info may be unavailable for some modules\n");
8054			}
8055			goto out;
8056		}
8057		err = btf_alloc_id(btf);
8058		if (err) {
8059			btf_free(btf);
8060			kfree(btf_mod);
8061			goto out;
8062		}
8063
8064		purge_cand_cache(NULL);
8065		mutex_lock(&btf_module_mutex);
8066		btf_mod->module = module;
8067		btf_mod->btf = btf;
8068		list_add(&btf_mod->list, &btf_modules);
8069		mutex_unlock(&btf_module_mutex);
8070
8071		if (IS_ENABLED(CONFIG_SYSFS)) {
8072			struct bin_attribute *attr;
8073
8074			attr = kzalloc(sizeof(*attr), GFP_KERNEL);
8075			if (!attr)
8076				goto out;
8077
8078			sysfs_bin_attr_init(attr);
8079			attr->attr.name = btf->name;
8080			attr->attr.mode = 0444;
8081			attr->size = btf->data_size;
8082			attr->private = btf;
8083			attr->read = btf_module_read;
8084
8085			err = sysfs_create_bin_file(btf_kobj, attr);
8086			if (err) {
8087				pr_warn("failed to register module [%s] BTF in sysfs: %d\n",
8088					mod->name, err);
8089				kfree(attr);
8090				err = 0;
8091				goto out;
8092			}
8093
8094			btf_mod->sysfs_attr = attr;
8095		}
8096
8097		break;
8098	case MODULE_STATE_LIVE:
8099		mutex_lock(&btf_module_mutex);
8100		list_for_each_entry_safe(btf_mod, tmp, &btf_modules, list) {
8101			if (btf_mod->module != module)
8102				continue;
8103
8104			btf_mod->flags |= BTF_MODULE_F_LIVE;
8105			break;
8106		}
8107		mutex_unlock(&btf_module_mutex);
8108		break;
8109	case MODULE_STATE_GOING:
8110		mutex_lock(&btf_module_mutex);
8111		list_for_each_entry_safe(btf_mod, tmp, &btf_modules, list) {
8112			if (btf_mod->module != module)
8113				continue;
8114
8115			list_del(&btf_mod->list);
8116			if (btf_mod->sysfs_attr)
8117				sysfs_remove_bin_file(btf_kobj, btf_mod->sysfs_attr);
8118			purge_cand_cache(btf_mod->btf);
8119			btf_put(btf_mod->btf);
8120			kfree(btf_mod->sysfs_attr);
8121			kfree(btf_mod);
8122			break;
8123		}
8124		mutex_unlock(&btf_module_mutex);
8125		break;
8126	}
8127out:
8128	return notifier_from_errno(err);
8129}
8130
8131static struct notifier_block btf_module_nb = {
8132	.notifier_call = btf_module_notify,
8133};
8134
8135static int __init btf_module_init(void)
8136{
8137	register_module_notifier(&btf_module_nb);
8138	return 0;
8139}
8140
8141fs_initcall(btf_module_init);
8142#endif /* CONFIG_DEBUG_INFO_BTF_MODULES */
8143
8144struct module *btf_try_get_module(const struct btf *btf)
8145{
8146	struct module *res = NULL;
8147#ifdef CONFIG_DEBUG_INFO_BTF_MODULES
8148	struct btf_module *btf_mod, *tmp;
8149
8150	mutex_lock(&btf_module_mutex);
8151	list_for_each_entry_safe(btf_mod, tmp, &btf_modules, list) {
8152		if (btf_mod->btf != btf)
8153			continue;
8154
8155		/* We must only consider module whose __init routine has
8156		 * finished, hence we must check for BTF_MODULE_F_LIVE flag,
8157		 * which is set from the notifier callback for
8158		 * MODULE_STATE_LIVE.
8159		 */
8160		if ((btf_mod->flags & BTF_MODULE_F_LIVE) && try_module_get(btf_mod->module))
8161			res = btf_mod->module;
8162
8163		break;
8164	}
8165	mutex_unlock(&btf_module_mutex);
8166#endif
8167
8168	return res;
8169}
8170
8171/* Returns struct btf corresponding to the struct module.
8172 * This function can return NULL or ERR_PTR.
8173 */
8174static struct btf *btf_get_module_btf(const struct module *module)
8175{
8176#ifdef CONFIG_DEBUG_INFO_BTF_MODULES
8177	struct btf_module *btf_mod, *tmp;
8178#endif
8179	struct btf *btf = NULL;
8180
8181	if (!module) {
8182		btf = bpf_get_btf_vmlinux();
8183		if (!IS_ERR_OR_NULL(btf))
8184			btf_get(btf);
8185		return btf;
8186	}
8187
8188#ifdef CONFIG_DEBUG_INFO_BTF_MODULES
8189	mutex_lock(&btf_module_mutex);
8190	list_for_each_entry_safe(btf_mod, tmp, &btf_modules, list) {
8191		if (btf_mod->module != module)
8192			continue;
8193
8194		btf_get(btf_mod->btf);
8195		btf = btf_mod->btf;
8196		break;
8197	}
8198	mutex_unlock(&btf_module_mutex);
8199#endif
8200
8201	return btf;
8202}
8203
8204static int check_btf_kconfigs(const struct module *module, const char *feature)
8205{
8206	if (!module && IS_ENABLED(CONFIG_DEBUG_INFO_BTF)) {
8207		pr_err("missing vmlinux BTF, cannot register %s\n", feature);
8208		return -ENOENT;
8209	}
8210	if (module && IS_ENABLED(CONFIG_DEBUG_INFO_BTF_MODULES))
8211		pr_warn("missing module BTF, cannot register %s\n", feature);
8212	return 0;
8213}
8214
8215BPF_CALL_4(bpf_btf_find_by_name_kind, char *, name, int, name_sz, u32, kind, int, flags)
8216{
8217	struct btf *btf = NULL;
8218	int btf_obj_fd = 0;
8219	long ret;
8220
8221	if (flags)
8222		return -EINVAL;
8223
8224	if (name_sz <= 1 || name[name_sz - 1])
8225		return -EINVAL;
8226
8227	ret = bpf_find_btf_id(name, kind, &btf);
8228	if (ret > 0 && btf_is_module(btf)) {
8229		btf_obj_fd = __btf_new_fd(btf);
8230		if (btf_obj_fd < 0) {
8231			btf_put(btf);
8232			return btf_obj_fd;
8233		}
8234		return ret | (((u64)btf_obj_fd) << 32);
8235	}
8236	if (ret > 0)
8237		btf_put(btf);
8238	return ret;
8239}
8240
8241const struct bpf_func_proto bpf_btf_find_by_name_kind_proto = {
8242	.func		= bpf_btf_find_by_name_kind,
8243	.gpl_only	= false,
8244	.ret_type	= RET_INTEGER,
8245	.arg1_type	= ARG_PTR_TO_MEM | MEM_RDONLY,
8246	.arg2_type	= ARG_CONST_SIZE,
8247	.arg3_type	= ARG_ANYTHING,
8248	.arg4_type	= ARG_ANYTHING,
8249};
8250
8251BTF_ID_LIST_GLOBAL(btf_tracing_ids, MAX_BTF_TRACING_TYPE)
8252#define BTF_TRACING_TYPE(name, type) BTF_ID(struct, type)
8253BTF_TRACING_TYPE_xxx
8254#undef BTF_TRACING_TYPE
8255
8256/* Validate well-formedness of iter argument type.
8257 * On success, return positive BTF ID of iter state's STRUCT type.
8258 * On error, negative error is returned.
8259 */
8260int btf_check_iter_arg(struct btf *btf, const struct btf_type *func, int arg_idx)
8261{
8262	const struct btf_param *arg;
8263	const struct btf_type *t;
8264	const char *name;
8265	int btf_id;
8266
8267	if (btf_type_vlen(func) <= arg_idx)
8268		return -EINVAL;
8269
8270	arg = &btf_params(func)[arg_idx];
8271	t = btf_type_skip_modifiers(btf, arg->type, NULL);
8272	if (!t || !btf_type_is_ptr(t))
8273		return -EINVAL;
8274	t = btf_type_skip_modifiers(btf, t->type, &btf_id);
8275	if (!t || !__btf_type_is_struct(t))
8276		return -EINVAL;
8277
8278	name = btf_name_by_offset(btf, t->name_off);
8279	if (!name || strncmp(name, ITER_PREFIX, sizeof(ITER_PREFIX) - 1))
8280		return -EINVAL;
8281
8282	return btf_id;
8283}
8284
8285static int btf_check_iter_kfuncs(struct btf *btf, const char *func_name,
8286				 const struct btf_type *func, u32 func_flags)
8287{
8288	u32 flags = func_flags & (KF_ITER_NEW | KF_ITER_NEXT | KF_ITER_DESTROY);
8289	const char *sfx, *iter_name;
8290	const struct btf_type *t;
8291	char exp_name[128];
8292	u32 nr_args;
8293	int btf_id;
8294
8295	/* exactly one of KF_ITER_{NEW,NEXT,DESTROY} can be set */
8296	if (!flags || (flags & (flags - 1)))
8297		return -EINVAL;
8298
8299	/* any BPF iter kfunc should have `struct bpf_iter_<type> *` first arg */
8300	nr_args = btf_type_vlen(func);
8301	if (nr_args < 1)
8302		return -EINVAL;
8303
8304	btf_id = btf_check_iter_arg(btf, func, 0);
8305	if (btf_id < 0)
8306		return btf_id;
8307
8308	/* sizeof(struct bpf_iter_<type>) should be a multiple of 8 to
8309	 * fit nicely in stack slots
8310	 */
8311	t = btf_type_by_id(btf, btf_id);
8312	if (t->size == 0 || (t->size % 8))
8313		return -EINVAL;
8314
8315	/* validate bpf_iter_<type>_{new,next,destroy}(struct bpf_iter_<type> *)
8316	 * naming pattern
8317	 */
8318	iter_name = btf_name_by_offset(btf, t->name_off) + sizeof(ITER_PREFIX) - 1;
8319	if (flags & KF_ITER_NEW)
8320		sfx = "new";
8321	else if (flags & KF_ITER_NEXT)
8322		sfx = "next";
8323	else /* (flags & KF_ITER_DESTROY) */
8324		sfx = "destroy";
8325
8326	snprintf(exp_name, sizeof(exp_name), "bpf_iter_%s_%s", iter_name, sfx);
8327	if (strcmp(func_name, exp_name))
8328		return -EINVAL;
8329
8330	/* only iter constructor should have extra arguments */
8331	if (!(flags & KF_ITER_NEW) && nr_args != 1)
8332		return -EINVAL;
8333
8334	if (flags & KF_ITER_NEXT) {
8335		/* bpf_iter_<type>_next() should return pointer */
8336		t = btf_type_skip_modifiers(btf, func->type, NULL);
8337		if (!t || !btf_type_is_ptr(t))
8338			return -EINVAL;
8339	}
8340
8341	if (flags & KF_ITER_DESTROY) {
8342		/* bpf_iter_<type>_destroy() should return void */
8343		t = btf_type_by_id(btf, func->type);
8344		if (!t || !btf_type_is_void(t))
8345			return -EINVAL;
8346	}
8347
8348	return 0;
8349}
8350
8351static int btf_check_kfunc_protos(struct btf *btf, u32 func_id, u32 func_flags)
8352{
8353	const struct btf_type *func;
8354	const char *func_name;
8355	int err;
8356
8357	/* any kfunc should be FUNC -> FUNC_PROTO */
8358	func = btf_type_by_id(btf, func_id);
8359	if (!func || !btf_type_is_func(func))
8360		return -EINVAL;
8361
8362	/* sanity check kfunc name */
8363	func_name = btf_name_by_offset(btf, func->name_off);
8364	if (!func_name || !func_name[0])
8365		return -EINVAL;
8366
8367	func = btf_type_by_id(btf, func->type);
8368	if (!func || !btf_type_is_func_proto(func))
8369		return -EINVAL;
8370
8371	if (func_flags & (KF_ITER_NEW | KF_ITER_NEXT | KF_ITER_DESTROY)) {
8372		err = btf_check_iter_kfuncs(btf, func_name, func, func_flags);
8373		if (err)
8374			return err;
8375	}
8376
8377	return 0;
8378}
8379
8380/* Kernel Function (kfunc) BTF ID set registration API */
8381
8382static int btf_populate_kfunc_set(struct btf *btf, enum btf_kfunc_hook hook,
8383				  const struct btf_kfunc_id_set *kset)
8384{
8385	struct btf_kfunc_hook_filter *hook_filter;
8386	struct btf_id_set8 *add_set = kset->set;
8387	bool vmlinux_set = !btf_is_module(btf);
8388	bool add_filter = !!kset->filter;
8389	struct btf_kfunc_set_tab *tab;
8390	struct btf_id_set8 *set;
8391	u32 set_cnt, i;
8392	int ret;
8393
8394	if (hook >= BTF_KFUNC_HOOK_MAX) {
8395		ret = -EINVAL;
8396		goto end;
8397	}
8398
8399	if (!add_set->cnt)
8400		return 0;
8401
8402	tab = btf->kfunc_set_tab;
8403
8404	if (tab && add_filter) {
8405		u32 i;
8406
8407		hook_filter = &tab->hook_filters[hook];
8408		for (i = 0; i < hook_filter->nr_filters; i++) {
8409			if (hook_filter->filters[i] == kset->filter) {
8410				add_filter = false;
8411				break;
8412			}
8413		}
8414
8415		if (add_filter && hook_filter->nr_filters == BTF_KFUNC_FILTER_MAX_CNT) {
8416			ret = -E2BIG;
8417			goto end;
8418		}
8419	}
8420
8421	if (!tab) {
8422		tab = kzalloc(sizeof(*tab), GFP_KERNEL | __GFP_NOWARN);
8423		if (!tab)
8424			return -ENOMEM;
8425		btf->kfunc_set_tab = tab;
8426	}
8427
8428	set = tab->sets[hook];
8429	/* Warn when register_btf_kfunc_id_set is called twice for the same hook
8430	 * for module sets.
8431	 */
8432	if (WARN_ON_ONCE(set && !vmlinux_set)) {
8433		ret = -EINVAL;
8434		goto end;
8435	}
8436
 
 
 
 
 
 
 
 
 
8437	/* In case of vmlinux sets, there may be more than one set being
8438	 * registered per hook. To create a unified set, we allocate a new set
8439	 * and concatenate all individual sets being registered. While each set
8440	 * is individually sorted, they may become unsorted when concatenated,
8441	 * hence re-sorting the final set again is required to make binary
8442	 * searching the set using btf_id_set8_contains function work.
8443	 *
8444	 * For module sets, we need to allocate as we may need to relocate
8445	 * BTF ids.
8446	 */
8447	set_cnt = set ? set->cnt : 0;
8448
8449	if (set_cnt > U32_MAX - add_set->cnt) {
8450		ret = -EOVERFLOW;
8451		goto end;
8452	}
8453
8454	if (set_cnt + add_set->cnt > BTF_KFUNC_SET_MAX_CNT) {
8455		ret = -E2BIG;
8456		goto end;
8457	}
8458
8459	/* Grow set */
8460	set = krealloc(tab->sets[hook],
8461		       offsetof(struct btf_id_set8, pairs[set_cnt + add_set->cnt]),
8462		       GFP_KERNEL | __GFP_NOWARN);
8463	if (!set) {
8464		ret = -ENOMEM;
8465		goto end;
8466	}
8467
8468	/* For newly allocated set, initialize set->cnt to 0 */
8469	if (!tab->sets[hook])
8470		set->cnt = 0;
8471	tab->sets[hook] = set;
8472
8473	/* Concatenate the two sets */
8474	memcpy(set->pairs + set->cnt, add_set->pairs, add_set->cnt * sizeof(set->pairs[0]));
8475	/* Now that the set is copied, update with relocated BTF ids */
8476	for (i = set->cnt; i < set->cnt + add_set->cnt; i++)
8477		set->pairs[i].id = btf_relocate_id(btf, set->pairs[i].id);
8478
8479	set->cnt += add_set->cnt;
8480
8481	sort(set->pairs, set->cnt, sizeof(set->pairs[0]), btf_id_cmp_func, NULL);
8482
8483	if (add_filter) {
8484		hook_filter = &tab->hook_filters[hook];
8485		hook_filter->filters[hook_filter->nr_filters++] = kset->filter;
8486	}
8487	return 0;
8488end:
8489	btf_free_kfunc_set_tab(btf);
8490	return ret;
8491}
8492
8493static u32 *__btf_kfunc_id_set_contains(const struct btf *btf,
8494					enum btf_kfunc_hook hook,
8495					u32 kfunc_btf_id,
8496					const struct bpf_prog *prog)
8497{
8498	struct btf_kfunc_hook_filter *hook_filter;
8499	struct btf_id_set8 *set;
8500	u32 *id, i;
8501
8502	if (hook >= BTF_KFUNC_HOOK_MAX)
8503		return NULL;
8504	if (!btf->kfunc_set_tab)
8505		return NULL;
8506	hook_filter = &btf->kfunc_set_tab->hook_filters[hook];
8507	for (i = 0; i < hook_filter->nr_filters; i++) {
8508		if (hook_filter->filters[i](prog, kfunc_btf_id))
8509			return NULL;
8510	}
8511	set = btf->kfunc_set_tab->sets[hook];
8512	if (!set)
8513		return NULL;
8514	id = btf_id_set8_contains(set, kfunc_btf_id);
8515	if (!id)
8516		return NULL;
8517	/* The flags for BTF ID are located next to it */
8518	return id + 1;
8519}
8520
8521static int bpf_prog_type_to_kfunc_hook(enum bpf_prog_type prog_type)
8522{
8523	switch (prog_type) {
8524	case BPF_PROG_TYPE_UNSPEC:
8525		return BTF_KFUNC_HOOK_COMMON;
8526	case BPF_PROG_TYPE_XDP:
8527		return BTF_KFUNC_HOOK_XDP;
8528	case BPF_PROG_TYPE_SCHED_CLS:
8529		return BTF_KFUNC_HOOK_TC;
8530	case BPF_PROG_TYPE_STRUCT_OPS:
8531		return BTF_KFUNC_HOOK_STRUCT_OPS;
8532	case BPF_PROG_TYPE_TRACING:
8533	case BPF_PROG_TYPE_TRACEPOINT:
8534	case BPF_PROG_TYPE_PERF_EVENT:
8535	case BPF_PROG_TYPE_LSM:
8536		return BTF_KFUNC_HOOK_TRACING;
8537	case BPF_PROG_TYPE_SYSCALL:
8538		return BTF_KFUNC_HOOK_SYSCALL;
8539	case BPF_PROG_TYPE_CGROUP_SKB:
8540	case BPF_PROG_TYPE_CGROUP_SOCK:
8541	case BPF_PROG_TYPE_CGROUP_DEVICE:
8542	case BPF_PROG_TYPE_CGROUP_SOCK_ADDR:
8543	case BPF_PROG_TYPE_CGROUP_SOCKOPT:
8544	case BPF_PROG_TYPE_CGROUP_SYSCTL:
8545		return BTF_KFUNC_HOOK_CGROUP;
8546	case BPF_PROG_TYPE_SCHED_ACT:
8547		return BTF_KFUNC_HOOK_SCHED_ACT;
8548	case BPF_PROG_TYPE_SK_SKB:
8549		return BTF_KFUNC_HOOK_SK_SKB;
8550	case BPF_PROG_TYPE_SOCKET_FILTER:
8551		return BTF_KFUNC_HOOK_SOCKET_FILTER;
8552	case BPF_PROG_TYPE_LWT_OUT:
8553	case BPF_PROG_TYPE_LWT_IN:
8554	case BPF_PROG_TYPE_LWT_XMIT:
8555	case BPF_PROG_TYPE_LWT_SEG6LOCAL:
8556		return BTF_KFUNC_HOOK_LWT;
8557	case BPF_PROG_TYPE_NETFILTER:
8558		return BTF_KFUNC_HOOK_NETFILTER;
8559	case BPF_PROG_TYPE_KPROBE:
8560		return BTF_KFUNC_HOOK_KPROBE;
8561	default:
8562		return BTF_KFUNC_HOOK_MAX;
8563	}
8564}
8565
8566/* Caution:
8567 * Reference to the module (obtained using btf_try_get_module) corresponding to
8568 * the struct btf *MUST* be held when calling this function from verifier
8569 * context. This is usually true as we stash references in prog's kfunc_btf_tab;
8570 * keeping the reference for the duration of the call provides the necessary
8571 * protection for looking up a well-formed btf->kfunc_set_tab.
8572 */
8573u32 *btf_kfunc_id_set_contains(const struct btf *btf,
8574			       u32 kfunc_btf_id,
8575			       const struct bpf_prog *prog)
8576{
8577	enum bpf_prog_type prog_type = resolve_prog_type(prog);
8578	enum btf_kfunc_hook hook;
8579	u32 *kfunc_flags;
8580
8581	kfunc_flags = __btf_kfunc_id_set_contains(btf, BTF_KFUNC_HOOK_COMMON, kfunc_btf_id, prog);
8582	if (kfunc_flags)
8583		return kfunc_flags;
8584
8585	hook = bpf_prog_type_to_kfunc_hook(prog_type);
8586	return __btf_kfunc_id_set_contains(btf, hook, kfunc_btf_id, prog);
8587}
8588
8589u32 *btf_kfunc_is_modify_return(const struct btf *btf, u32 kfunc_btf_id,
8590				const struct bpf_prog *prog)
8591{
8592	return __btf_kfunc_id_set_contains(btf, BTF_KFUNC_HOOK_FMODRET, kfunc_btf_id, prog);
8593}
8594
8595static int __register_btf_kfunc_id_set(enum btf_kfunc_hook hook,
8596				       const struct btf_kfunc_id_set *kset)
8597{
8598	struct btf *btf;
8599	int ret, i;
8600
8601	btf = btf_get_module_btf(kset->owner);
8602	if (!btf)
8603		return check_btf_kconfigs(kset->owner, "kfunc");
 
 
 
 
 
 
 
 
 
8604	if (IS_ERR(btf))
8605		return PTR_ERR(btf);
8606
8607	for (i = 0; i < kset->set->cnt; i++) {
8608		ret = btf_check_kfunc_protos(btf, btf_relocate_id(btf, kset->set->pairs[i].id),
8609					     kset->set->pairs[i].flags);
8610		if (ret)
8611			goto err_out;
8612	}
8613
8614	ret = btf_populate_kfunc_set(btf, hook, kset);
8615
8616err_out:
8617	btf_put(btf);
8618	return ret;
8619}
8620
8621/* This function must be invoked only from initcalls/module init functions */
8622int register_btf_kfunc_id_set(enum bpf_prog_type prog_type,
8623			      const struct btf_kfunc_id_set *kset)
8624{
8625	enum btf_kfunc_hook hook;
8626
8627	/* All kfuncs need to be tagged as such in BTF.
8628	 * WARN() for initcall registrations that do not check errors.
8629	 */
8630	if (!(kset->set->flags & BTF_SET8_KFUNCS)) {
8631		WARN_ON(!kset->owner);
8632		return -EINVAL;
8633	}
8634
8635	hook = bpf_prog_type_to_kfunc_hook(prog_type);
8636	return __register_btf_kfunc_id_set(hook, kset);
8637}
8638EXPORT_SYMBOL_GPL(register_btf_kfunc_id_set);
8639
8640/* This function must be invoked only from initcalls/module init functions */
8641int register_btf_fmodret_id_set(const struct btf_kfunc_id_set *kset)
8642{
8643	return __register_btf_kfunc_id_set(BTF_KFUNC_HOOK_FMODRET, kset);
8644}
8645EXPORT_SYMBOL_GPL(register_btf_fmodret_id_set);
8646
8647s32 btf_find_dtor_kfunc(struct btf *btf, u32 btf_id)
8648{
8649	struct btf_id_dtor_kfunc_tab *tab = btf->dtor_kfunc_tab;
8650	struct btf_id_dtor_kfunc *dtor;
8651
8652	if (!tab)
8653		return -ENOENT;
8654	/* Even though the size of tab->dtors[0] is > sizeof(u32), we only need
8655	 * to compare the first u32 with btf_id, so we can reuse btf_id_cmp_func.
8656	 */
8657	BUILD_BUG_ON(offsetof(struct btf_id_dtor_kfunc, btf_id) != 0);
8658	dtor = bsearch(&btf_id, tab->dtors, tab->cnt, sizeof(tab->dtors[0]), btf_id_cmp_func);
8659	if (!dtor)
8660		return -ENOENT;
8661	return dtor->kfunc_btf_id;
8662}
8663
8664static int btf_check_dtor_kfuncs(struct btf *btf, const struct btf_id_dtor_kfunc *dtors, u32 cnt)
8665{
8666	const struct btf_type *dtor_func, *dtor_func_proto, *t;
8667	const struct btf_param *args;
8668	s32 dtor_btf_id;
8669	u32 nr_args, i;
8670
8671	for (i = 0; i < cnt; i++) {
8672		dtor_btf_id = btf_relocate_id(btf, dtors[i].kfunc_btf_id);
8673
8674		dtor_func = btf_type_by_id(btf, dtor_btf_id);
8675		if (!dtor_func || !btf_type_is_func(dtor_func))
8676			return -EINVAL;
8677
8678		dtor_func_proto = btf_type_by_id(btf, dtor_func->type);
8679		if (!dtor_func_proto || !btf_type_is_func_proto(dtor_func_proto))
8680			return -EINVAL;
8681
8682		/* Make sure the prototype of the destructor kfunc is 'void func(type *)' */
8683		t = btf_type_by_id(btf, dtor_func_proto->type);
8684		if (!t || !btf_type_is_void(t))
8685			return -EINVAL;
8686
8687		nr_args = btf_type_vlen(dtor_func_proto);
8688		if (nr_args != 1)
8689			return -EINVAL;
8690		args = btf_params(dtor_func_proto);
8691		t = btf_type_by_id(btf, args[0].type);
8692		/* Allow any pointer type, as width on targets Linux supports
8693		 * will be same for all pointer types (i.e. sizeof(void *))
8694		 */
8695		if (!t || !btf_type_is_ptr(t))
8696			return -EINVAL;
8697	}
8698	return 0;
8699}
8700
8701/* This function must be invoked only from initcalls/module init functions */
8702int register_btf_id_dtor_kfuncs(const struct btf_id_dtor_kfunc *dtors, u32 add_cnt,
8703				struct module *owner)
8704{
8705	struct btf_id_dtor_kfunc_tab *tab;
8706	struct btf *btf;
8707	u32 tab_cnt, i;
8708	int ret;
8709
8710	btf = btf_get_module_btf(owner);
8711	if (!btf)
8712		return check_btf_kconfigs(owner, "dtor kfuncs");
 
 
 
 
 
 
 
 
 
8713	if (IS_ERR(btf))
8714		return PTR_ERR(btf);
8715
8716	if (add_cnt >= BTF_DTOR_KFUNC_MAX_CNT) {
8717		pr_err("cannot register more than %d kfunc destructors\n", BTF_DTOR_KFUNC_MAX_CNT);
8718		ret = -E2BIG;
8719		goto end;
8720	}
8721
8722	/* Ensure that the prototype of dtor kfuncs being registered is sane */
8723	ret = btf_check_dtor_kfuncs(btf, dtors, add_cnt);
8724	if (ret < 0)
8725		goto end;
8726
8727	tab = btf->dtor_kfunc_tab;
8728	/* Only one call allowed for modules */
8729	if (WARN_ON_ONCE(tab && btf_is_module(btf))) {
8730		ret = -EINVAL;
8731		goto end;
8732	}
8733
8734	tab_cnt = tab ? tab->cnt : 0;
8735	if (tab_cnt > U32_MAX - add_cnt) {
8736		ret = -EOVERFLOW;
8737		goto end;
8738	}
8739	if (tab_cnt + add_cnt >= BTF_DTOR_KFUNC_MAX_CNT) {
8740		pr_err("cannot register more than %d kfunc destructors\n", BTF_DTOR_KFUNC_MAX_CNT);
8741		ret = -E2BIG;
8742		goto end;
8743	}
8744
8745	tab = krealloc(btf->dtor_kfunc_tab,
8746		       offsetof(struct btf_id_dtor_kfunc_tab, dtors[tab_cnt + add_cnt]),
8747		       GFP_KERNEL | __GFP_NOWARN);
8748	if (!tab) {
8749		ret = -ENOMEM;
8750		goto end;
8751	}
8752
8753	if (!btf->dtor_kfunc_tab)
8754		tab->cnt = 0;
8755	btf->dtor_kfunc_tab = tab;
8756
8757	memcpy(tab->dtors + tab->cnt, dtors, add_cnt * sizeof(tab->dtors[0]));
8758
8759	/* remap BTF ids based on BTF relocation (if any) */
8760	for (i = tab_cnt; i < tab_cnt + add_cnt; i++) {
8761		tab->dtors[i].btf_id = btf_relocate_id(btf, tab->dtors[i].btf_id);
8762		tab->dtors[i].kfunc_btf_id = btf_relocate_id(btf, tab->dtors[i].kfunc_btf_id);
8763	}
8764
8765	tab->cnt += add_cnt;
8766
8767	sort(tab->dtors, tab->cnt, sizeof(tab->dtors[0]), btf_id_cmp_func, NULL);
8768
8769end:
8770	if (ret)
8771		btf_free_dtor_kfunc_tab(btf);
8772	btf_put(btf);
8773	return ret;
8774}
8775EXPORT_SYMBOL_GPL(register_btf_id_dtor_kfuncs);
8776
8777#define MAX_TYPES_ARE_COMPAT_DEPTH 2
8778
8779/* Check local and target types for compatibility. This check is used for
8780 * type-based CO-RE relocations and follow slightly different rules than
8781 * field-based relocations. This function assumes that root types were already
8782 * checked for name match. Beyond that initial root-level name check, names
8783 * are completely ignored. Compatibility rules are as follows:
8784 *   - any two STRUCTs/UNIONs/FWDs/ENUMs/INTs/ENUM64s are considered compatible, but
8785 *     kind should match for local and target types (i.e., STRUCT is not
8786 *     compatible with UNION);
8787 *   - for ENUMs/ENUM64s, the size is ignored;
8788 *   - for INT, size and signedness are ignored;
8789 *   - for ARRAY, dimensionality is ignored, element types are checked for
8790 *     compatibility recursively;
8791 *   - CONST/VOLATILE/RESTRICT modifiers are ignored;
8792 *   - TYPEDEFs/PTRs are compatible if types they pointing to are compatible;
8793 *   - FUNC_PROTOs are compatible if they have compatible signature: same
8794 *     number of input args and compatible return and argument types.
8795 * These rules are not set in stone and probably will be adjusted as we get
8796 * more experience with using BPF CO-RE relocations.
8797 */
8798int bpf_core_types_are_compat(const struct btf *local_btf, __u32 local_id,
8799			      const struct btf *targ_btf, __u32 targ_id)
8800{
8801	return __bpf_core_types_are_compat(local_btf, local_id, targ_btf, targ_id,
8802					   MAX_TYPES_ARE_COMPAT_DEPTH);
8803}
8804
8805#define MAX_TYPES_MATCH_DEPTH 2
8806
8807int bpf_core_types_match(const struct btf *local_btf, u32 local_id,
8808			 const struct btf *targ_btf, u32 targ_id)
8809{
8810	return __bpf_core_types_match(local_btf, local_id, targ_btf, targ_id, false,
8811				      MAX_TYPES_MATCH_DEPTH);
8812}
8813
8814static bool bpf_core_is_flavor_sep(const char *s)
8815{
8816	/* check X___Y name pattern, where X and Y are not underscores */
8817	return s[0] != '_' &&				      /* X */
8818	       s[1] == '_' && s[2] == '_' && s[3] == '_' &&   /* ___ */
8819	       s[4] != '_';				      /* Y */
8820}
8821
8822size_t bpf_core_essential_name_len(const char *name)
8823{
8824	size_t n = strlen(name);
8825	int i;
8826
8827	for (i = n - 5; i >= 0; i--) {
8828		if (bpf_core_is_flavor_sep(name + i))
8829			return i + 1;
8830	}
8831	return n;
8832}
8833
 
 
 
 
 
 
 
 
 
 
 
8834static void bpf_free_cands(struct bpf_cand_cache *cands)
8835{
8836	if (!cands->cnt)
8837		/* empty candidate array was allocated on stack */
8838		return;
8839	kfree(cands);
8840}
8841
8842static void bpf_free_cands_from_cache(struct bpf_cand_cache *cands)
8843{
8844	kfree(cands->name);
8845	kfree(cands);
8846}
8847
8848#define VMLINUX_CAND_CACHE_SIZE 31
8849static struct bpf_cand_cache *vmlinux_cand_cache[VMLINUX_CAND_CACHE_SIZE];
8850
8851#define MODULE_CAND_CACHE_SIZE 31
8852static struct bpf_cand_cache *module_cand_cache[MODULE_CAND_CACHE_SIZE];
8853
 
 
8854static void __print_cand_cache(struct bpf_verifier_log *log,
8855			       struct bpf_cand_cache **cache,
8856			       int cache_size)
8857{
8858	struct bpf_cand_cache *cc;
8859	int i, j;
8860
8861	for (i = 0; i < cache_size; i++) {
8862		cc = cache[i];
8863		if (!cc)
8864			continue;
8865		bpf_log(log, "[%d]%s(", i, cc->name);
8866		for (j = 0; j < cc->cnt; j++) {
8867			bpf_log(log, "%d", cc->cands[j].id);
8868			if (j < cc->cnt - 1)
8869				bpf_log(log, " ");
8870		}
8871		bpf_log(log, "), ");
8872	}
8873}
8874
8875static void print_cand_cache(struct bpf_verifier_log *log)
8876{
8877	mutex_lock(&cand_cache_mutex);
8878	bpf_log(log, "vmlinux_cand_cache:");
8879	__print_cand_cache(log, vmlinux_cand_cache, VMLINUX_CAND_CACHE_SIZE);
8880	bpf_log(log, "\nmodule_cand_cache:");
8881	__print_cand_cache(log, module_cand_cache, MODULE_CAND_CACHE_SIZE);
8882	bpf_log(log, "\n");
8883	mutex_unlock(&cand_cache_mutex);
8884}
8885
8886static u32 hash_cands(struct bpf_cand_cache *cands)
8887{
8888	return jhash(cands->name, cands->name_len, 0);
8889}
8890
8891static struct bpf_cand_cache *check_cand_cache(struct bpf_cand_cache *cands,
8892					       struct bpf_cand_cache **cache,
8893					       int cache_size)
8894{
8895	struct bpf_cand_cache *cc = cache[hash_cands(cands) % cache_size];
8896
8897	if (cc && cc->name_len == cands->name_len &&
8898	    !strncmp(cc->name, cands->name, cands->name_len))
8899		return cc;
8900	return NULL;
8901}
8902
8903static size_t sizeof_cands(int cnt)
8904{
8905	return offsetof(struct bpf_cand_cache, cands[cnt]);
8906}
8907
8908static struct bpf_cand_cache *populate_cand_cache(struct bpf_cand_cache *cands,
8909						  struct bpf_cand_cache **cache,
8910						  int cache_size)
8911{
8912	struct bpf_cand_cache **cc = &cache[hash_cands(cands) % cache_size], *new_cands;
8913
8914	if (*cc) {
8915		bpf_free_cands_from_cache(*cc);
8916		*cc = NULL;
8917	}
8918	new_cands = kmemdup(cands, sizeof_cands(cands->cnt), GFP_KERNEL);
8919	if (!new_cands) {
8920		bpf_free_cands(cands);
8921		return ERR_PTR(-ENOMEM);
8922	}
8923	/* strdup the name, since it will stay in cache.
8924	 * the cands->name points to strings in prog's BTF and the prog can be unloaded.
8925	 */
8926	new_cands->name = kmemdup_nul(cands->name, cands->name_len, GFP_KERNEL);
8927	bpf_free_cands(cands);
8928	if (!new_cands->name) {
8929		kfree(new_cands);
8930		return ERR_PTR(-ENOMEM);
8931	}
8932	*cc = new_cands;
8933	return new_cands;
8934}
8935
8936#ifdef CONFIG_DEBUG_INFO_BTF_MODULES
8937static void __purge_cand_cache(struct btf *btf, struct bpf_cand_cache **cache,
8938			       int cache_size)
8939{
8940	struct bpf_cand_cache *cc;
8941	int i, j;
8942
8943	for (i = 0; i < cache_size; i++) {
8944		cc = cache[i];
8945		if (!cc)
8946			continue;
8947		if (!btf) {
8948			/* when new module is loaded purge all of module_cand_cache,
8949			 * since new module might have candidates with the name
8950			 * that matches cached cands.
8951			 */
8952			bpf_free_cands_from_cache(cc);
8953			cache[i] = NULL;
8954			continue;
8955		}
8956		/* when module is unloaded purge cache entries
8957		 * that match module's btf
8958		 */
8959		for (j = 0; j < cc->cnt; j++)
8960			if (cc->cands[j].btf == btf) {
8961				bpf_free_cands_from_cache(cc);
8962				cache[i] = NULL;
8963				break;
8964			}
8965	}
8966
8967}
8968
8969static void purge_cand_cache(struct btf *btf)
8970{
8971	mutex_lock(&cand_cache_mutex);
8972	__purge_cand_cache(btf, module_cand_cache, MODULE_CAND_CACHE_SIZE);
8973	mutex_unlock(&cand_cache_mutex);
8974}
8975#endif
8976
8977static struct bpf_cand_cache *
8978bpf_core_add_cands(struct bpf_cand_cache *cands, const struct btf *targ_btf,
8979		   int targ_start_id)
8980{
8981	struct bpf_cand_cache *new_cands;
8982	const struct btf_type *t;
8983	const char *targ_name;
8984	size_t targ_essent_len;
8985	int n, i;
8986
8987	n = btf_nr_types(targ_btf);
8988	for (i = targ_start_id; i < n; i++) {
8989		t = btf_type_by_id(targ_btf, i);
8990		if (btf_kind(t) != cands->kind)
8991			continue;
8992
8993		targ_name = btf_name_by_offset(targ_btf, t->name_off);
8994		if (!targ_name)
8995			continue;
8996
8997		/* the resched point is before strncmp to make sure that search
8998		 * for non-existing name will have a chance to schedule().
8999		 */
9000		cond_resched();
9001
9002		if (strncmp(cands->name, targ_name, cands->name_len) != 0)
9003			continue;
9004
9005		targ_essent_len = bpf_core_essential_name_len(targ_name);
9006		if (targ_essent_len != cands->name_len)
9007			continue;
9008
9009		/* most of the time there is only one candidate for a given kind+name pair */
9010		new_cands = kmalloc(sizeof_cands(cands->cnt + 1), GFP_KERNEL);
9011		if (!new_cands) {
9012			bpf_free_cands(cands);
9013			return ERR_PTR(-ENOMEM);
9014		}
9015
9016		memcpy(new_cands, cands, sizeof_cands(cands->cnt));
9017		bpf_free_cands(cands);
9018		cands = new_cands;
9019		cands->cands[cands->cnt].btf = targ_btf;
9020		cands->cands[cands->cnt].id = i;
9021		cands->cnt++;
9022	}
9023	return cands;
9024}
9025
9026static struct bpf_cand_cache *
9027bpf_core_find_cands(struct bpf_core_ctx *ctx, u32 local_type_id)
9028{
9029	struct bpf_cand_cache *cands, *cc, local_cand = {};
9030	const struct btf *local_btf = ctx->btf;
9031	const struct btf_type *local_type;
9032	const struct btf *main_btf;
9033	size_t local_essent_len;
9034	struct btf *mod_btf;
9035	const char *name;
9036	int id;
9037
9038	main_btf = bpf_get_btf_vmlinux();
9039	if (IS_ERR(main_btf))
9040		return ERR_CAST(main_btf);
9041	if (!main_btf)
9042		return ERR_PTR(-EINVAL);
9043
9044	local_type = btf_type_by_id(local_btf, local_type_id);
9045	if (!local_type)
9046		return ERR_PTR(-EINVAL);
9047
9048	name = btf_name_by_offset(local_btf, local_type->name_off);
9049	if (str_is_empty(name))
9050		return ERR_PTR(-EINVAL);
9051	local_essent_len = bpf_core_essential_name_len(name);
9052
9053	cands = &local_cand;
9054	cands->name = name;
9055	cands->kind = btf_kind(local_type);
9056	cands->name_len = local_essent_len;
9057
9058	cc = check_cand_cache(cands, vmlinux_cand_cache, VMLINUX_CAND_CACHE_SIZE);
9059	/* cands is a pointer to stack here */
9060	if (cc) {
9061		if (cc->cnt)
9062			return cc;
9063		goto check_modules;
9064	}
9065
9066	/* Attempt to find target candidates in vmlinux BTF first */
9067	cands = bpf_core_add_cands(cands, main_btf, 1);
9068	if (IS_ERR(cands))
9069		return ERR_CAST(cands);
9070
9071	/* cands is a pointer to kmalloced memory here if cands->cnt > 0 */
9072
9073	/* populate cache even when cands->cnt == 0 */
9074	cc = populate_cand_cache(cands, vmlinux_cand_cache, VMLINUX_CAND_CACHE_SIZE);
9075	if (IS_ERR(cc))
9076		return ERR_CAST(cc);
9077
9078	/* if vmlinux BTF has any candidate, don't go for module BTFs */
9079	if (cc->cnt)
9080		return cc;
9081
9082check_modules:
9083	/* cands is a pointer to stack here and cands->cnt == 0 */
9084	cc = check_cand_cache(cands, module_cand_cache, MODULE_CAND_CACHE_SIZE);
9085	if (cc)
9086		/* if cache has it return it even if cc->cnt == 0 */
9087		return cc;
9088
9089	/* If candidate is not found in vmlinux's BTF then search in module's BTFs */
9090	spin_lock_bh(&btf_idr_lock);
9091	idr_for_each_entry(&btf_idr, mod_btf, id) {
9092		if (!btf_is_module(mod_btf))
9093			continue;
9094		/* linear search could be slow hence unlock/lock
9095		 * the IDR to avoiding holding it for too long
9096		 */
9097		btf_get(mod_btf);
9098		spin_unlock_bh(&btf_idr_lock);
9099		cands = bpf_core_add_cands(cands, mod_btf, btf_nr_types(main_btf));
9100		btf_put(mod_btf);
9101		if (IS_ERR(cands))
9102			return ERR_CAST(cands);
 
9103		spin_lock_bh(&btf_idr_lock);
 
9104	}
9105	spin_unlock_bh(&btf_idr_lock);
9106	/* cands is a pointer to kmalloced memory here if cands->cnt > 0
9107	 * or pointer to stack if cands->cnd == 0.
9108	 * Copy it into the cache even when cands->cnt == 0 and
9109	 * return the result.
9110	 */
9111	return populate_cand_cache(cands, module_cand_cache, MODULE_CAND_CACHE_SIZE);
9112}
9113
9114int bpf_core_apply(struct bpf_core_ctx *ctx, const struct bpf_core_relo *relo,
9115		   int relo_idx, void *insn)
9116{
9117	bool need_cands = relo->kind != BPF_CORE_TYPE_ID_LOCAL;
9118	struct bpf_core_cand_list cands = {};
9119	struct bpf_core_relo_res targ_res;
9120	struct bpf_core_spec *specs;
9121	const struct btf_type *type;
9122	int err;
9123
9124	/* ~4k of temp memory necessary to convert LLVM spec like "0:1:0:5"
9125	 * into arrays of btf_ids of struct fields and array indices.
9126	 */
9127	specs = kcalloc(3, sizeof(*specs), GFP_KERNEL);
9128	if (!specs)
9129		return -ENOMEM;
9130
9131	type = btf_type_by_id(ctx->btf, relo->type_id);
9132	if (!type) {
9133		bpf_log(ctx->log, "relo #%u: bad type id %u\n",
9134			relo_idx, relo->type_id);
9135		kfree(specs);
9136		return -EINVAL;
9137	}
9138
9139	if (need_cands) {
9140		struct bpf_cand_cache *cc;
9141		int i;
9142
9143		mutex_lock(&cand_cache_mutex);
9144		cc = bpf_core_find_cands(ctx, relo->type_id);
9145		if (IS_ERR(cc)) {
9146			bpf_log(ctx->log, "target candidate search failed for %d\n",
9147				relo->type_id);
9148			err = PTR_ERR(cc);
9149			goto out;
9150		}
9151		if (cc->cnt) {
9152			cands.cands = kcalloc(cc->cnt, sizeof(*cands.cands), GFP_KERNEL);
9153			if (!cands.cands) {
9154				err = -ENOMEM;
9155				goto out;
9156			}
9157		}
9158		for (i = 0; i < cc->cnt; i++) {
9159			bpf_log(ctx->log,
9160				"CO-RE relocating %s %s: found target candidate [%d]\n",
9161				btf_kind_str[cc->kind], cc->name, cc->cands[i].id);
9162			cands.cands[i].btf = cc->cands[i].btf;
9163			cands.cands[i].id = cc->cands[i].id;
9164		}
9165		cands.len = cc->cnt;
9166		/* cand_cache_mutex needs to span the cache lookup and
9167		 * copy of btf pointer into bpf_core_cand_list,
9168		 * since module can be unloaded while bpf_core_calc_relo_insn
9169		 * is working with module's btf.
9170		 */
9171	}
9172
9173	err = bpf_core_calc_relo_insn((void *)ctx->log, relo, relo_idx, ctx->btf, &cands, specs,
9174				      &targ_res);
9175	if (err)
9176		goto out;
9177
9178	err = bpf_core_patch_insn((void *)ctx->log, insn, relo->insn_off / 8, relo, relo_idx,
9179				  &targ_res);
9180
9181out:
9182	kfree(specs);
9183	if (need_cands) {
9184		kfree(cands.cands);
9185		mutex_unlock(&cand_cache_mutex);
9186		if (ctx->log->level & BPF_LOG_LEVEL2)
9187			print_cand_cache(ctx->log);
9188	}
9189	return err;
9190}
9191
9192bool btf_nested_type_is_trusted(struct bpf_verifier_log *log,
9193				const struct bpf_reg_state *reg,
9194				const char *field_name, u32 btf_id, const char *suffix)
9195{
9196	struct btf *btf = reg->btf;
9197	const struct btf_type *walk_type, *safe_type;
9198	const char *tname;
9199	char safe_tname[64];
9200	long ret, safe_id;
9201	const struct btf_member *member;
9202	u32 i;
9203
9204	walk_type = btf_type_by_id(btf, reg->btf_id);
9205	if (!walk_type)
9206		return false;
9207
9208	tname = btf_name_by_offset(btf, walk_type->name_off);
9209
9210	ret = snprintf(safe_tname, sizeof(safe_tname), "%s%s", tname, suffix);
9211	if (ret >= sizeof(safe_tname))
9212		return false;
9213
9214	safe_id = btf_find_by_name_kind(btf, safe_tname, BTF_INFO_KIND(walk_type->info));
9215	if (safe_id < 0)
9216		return false;
9217
9218	safe_type = btf_type_by_id(btf, safe_id);
9219	if (!safe_type)
9220		return false;
9221
9222	for_each_member(i, safe_type, member) {
9223		const char *m_name = __btf_name_by_offset(btf, member->name_off);
9224		const struct btf_type *mtype = btf_type_by_id(btf, member->type);
9225		u32 id;
9226
9227		if (!btf_type_is_ptr(mtype))
9228			continue;
9229
9230		btf_type_skip_modifiers(btf, mtype->type, &id);
9231		/* If we match on both type and name, the field is considered trusted. */
9232		if (btf_id == id && !strcmp(field_name, m_name))
9233			return true;
9234	}
9235
9236	return false;
9237}
9238
9239bool btf_type_ids_nocast_alias(struct bpf_verifier_log *log,
9240			       const struct btf *reg_btf, u32 reg_id,
9241			       const struct btf *arg_btf, u32 arg_id)
9242{
9243	const char *reg_name, *arg_name, *search_needle;
9244	const struct btf_type *reg_type, *arg_type;
9245	int reg_len, arg_len, cmp_len;
9246	size_t pattern_len = sizeof(NOCAST_ALIAS_SUFFIX) - sizeof(char);
9247
9248	reg_type = btf_type_by_id(reg_btf, reg_id);
9249	if (!reg_type)
9250		return false;
9251
9252	arg_type = btf_type_by_id(arg_btf, arg_id);
9253	if (!arg_type)
9254		return false;
9255
9256	reg_name = btf_name_by_offset(reg_btf, reg_type->name_off);
9257	arg_name = btf_name_by_offset(arg_btf, arg_type->name_off);
9258
9259	reg_len = strlen(reg_name);
9260	arg_len = strlen(arg_name);
9261
9262	/* Exactly one of the two type names may be suffixed with ___init, so
9263	 * if the strings are the same size, they can't possibly be no-cast
9264	 * aliases of one another. If you have two of the same type names, e.g.
9265	 * they're both nf_conn___init, it would be improper to return true
9266	 * because they are _not_ no-cast aliases, they are the same type.
9267	 */
9268	if (reg_len == arg_len)
9269		return false;
9270
9271	/* Either of the two names must be the other name, suffixed with ___init. */
9272	if ((reg_len != arg_len + pattern_len) &&
9273	    (arg_len != reg_len + pattern_len))
9274		return false;
9275
9276	if (reg_len < arg_len) {
9277		search_needle = strstr(arg_name, NOCAST_ALIAS_SUFFIX);
9278		cmp_len = reg_len;
9279	} else {
9280		search_needle = strstr(reg_name, NOCAST_ALIAS_SUFFIX);
9281		cmp_len = arg_len;
9282	}
9283
9284	if (!search_needle)
9285		return false;
9286
9287	/* ___init suffix must come at the end of the name */
9288	if (*(search_needle + pattern_len) != '\0')
9289		return false;
9290
9291	return !strncmp(reg_name, arg_name, cmp_len);
9292}
9293
9294#ifdef CONFIG_BPF_JIT
9295static int
9296btf_add_struct_ops(struct btf *btf, struct bpf_struct_ops *st_ops,
9297		   struct bpf_verifier_log *log)
9298{
9299	struct btf_struct_ops_tab *tab, *new_tab;
9300	int i, err;
9301
9302	tab = btf->struct_ops_tab;
9303	if (!tab) {
9304		tab = kzalloc(offsetof(struct btf_struct_ops_tab, ops[4]),
9305			      GFP_KERNEL);
9306		if (!tab)
9307			return -ENOMEM;
9308		tab->capacity = 4;
9309		btf->struct_ops_tab = tab;
9310	}
9311
9312	for (i = 0; i < tab->cnt; i++)
9313		if (tab->ops[i].st_ops == st_ops)
9314			return -EEXIST;
9315
9316	if (tab->cnt == tab->capacity) {
9317		new_tab = krealloc(tab,
9318				   offsetof(struct btf_struct_ops_tab,
9319					    ops[tab->capacity * 2]),
9320				   GFP_KERNEL);
9321		if (!new_tab)
9322			return -ENOMEM;
9323		tab = new_tab;
9324		tab->capacity *= 2;
9325		btf->struct_ops_tab = tab;
9326	}
9327
9328	tab->ops[btf->struct_ops_tab->cnt].st_ops = st_ops;
9329
9330	err = bpf_struct_ops_desc_init(&tab->ops[btf->struct_ops_tab->cnt], btf, log);
9331	if (err)
9332		return err;
9333
9334	btf->struct_ops_tab->cnt++;
9335
9336	return 0;
9337}
9338
9339const struct bpf_struct_ops_desc *
9340bpf_struct_ops_find_value(struct btf *btf, u32 value_id)
9341{
9342	const struct bpf_struct_ops_desc *st_ops_list;
9343	unsigned int i;
9344	u32 cnt;
9345
9346	if (!value_id)
9347		return NULL;
9348	if (!btf->struct_ops_tab)
9349		return NULL;
9350
9351	cnt = btf->struct_ops_tab->cnt;
9352	st_ops_list = btf->struct_ops_tab->ops;
9353	for (i = 0; i < cnt; i++) {
9354		if (st_ops_list[i].value_id == value_id)
9355			return &st_ops_list[i];
9356	}
9357
9358	return NULL;
9359}
9360
9361const struct bpf_struct_ops_desc *
9362bpf_struct_ops_find(struct btf *btf, u32 type_id)
9363{
9364	const struct bpf_struct_ops_desc *st_ops_list;
9365	unsigned int i;
9366	u32 cnt;
9367
9368	if (!type_id)
9369		return NULL;
9370	if (!btf->struct_ops_tab)
9371		return NULL;
9372
9373	cnt = btf->struct_ops_tab->cnt;
9374	st_ops_list = btf->struct_ops_tab->ops;
9375	for (i = 0; i < cnt; i++) {
9376		if (st_ops_list[i].type_id == type_id)
9377			return &st_ops_list[i];
9378	}
9379
9380	return NULL;
9381}
9382
9383int __register_bpf_struct_ops(struct bpf_struct_ops *st_ops)
9384{
9385	struct bpf_verifier_log *log;
9386	struct btf *btf;
9387	int err = 0;
9388
9389	btf = btf_get_module_btf(st_ops->owner);
9390	if (!btf)
9391		return check_btf_kconfigs(st_ops->owner, "struct_ops");
9392	if (IS_ERR(btf))
9393		return PTR_ERR(btf);
9394
9395	log = kzalloc(sizeof(*log), GFP_KERNEL | __GFP_NOWARN);
9396	if (!log) {
9397		err = -ENOMEM;
9398		goto errout;
9399	}
9400
9401	log->level = BPF_LOG_KERNEL;
9402
9403	err = btf_add_struct_ops(btf, st_ops, log);
9404
9405errout:
9406	kfree(log);
9407	btf_put(btf);
9408
9409	return err;
9410}
9411EXPORT_SYMBOL_GPL(__register_bpf_struct_ops);
9412#endif
9413
9414bool btf_param_match_suffix(const struct btf *btf,
9415			    const struct btf_param *arg,
9416			    const char *suffix)
9417{
9418	int suffix_len = strlen(suffix), len;
9419	const char *param_name;
9420
9421	/* In the future, this can be ported to use BTF tagging */
9422	param_name = btf_name_by_offset(btf, arg->name_off);
9423	if (str_is_empty(param_name))
9424		return false;
9425	len = strlen(param_name);
9426	if (len <= suffix_len)
9427		return false;
9428	param_name += len - suffix_len;
9429	return !strncmp(param_name, suffix, suffix_len);
9430}